b4f6c5f7ee2572f16ac43d309919fb519b76cae56e324f0abc7574ca6b567947

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EpsilonSpaceWorld.exe
Size 139.5MB
Sample240114-29pykadebm
SHA256 a96369ae9bd344ca998d4d89148f0da3162a3b55fd70ee1754b4e8178d75d422
MD5 f88375ed6eef445c77d69e5d0b9e694f
SHA1 8a25116bdb9ca3704378f8d5174b40129cfc38ab
SHA512 83446e7631e4c93a265fb4cd38c1b63b817838cda88f318804ff25ce247426e6b3f5691055d454d8a3591d22904354095eba52b66372682b28f8d9cd6180cecb
SSDEEP 786432:/14w5ThzHwQBgmoLWv+K18nCzKdo5DTdvfMQr6SSmPuvh8tSIW68:/14kpHwQjCWv+K18CedmVvEQEpcJW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2508	EpsilonSpaceWorld.exe
2508	EpsilonSpaceWorld.exe
2508	EpsilonSpaceWorld.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EpsilonSpaceWorld.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	EpsilonSpaceWorld.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	EpsilonSpaceWorld.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	EpsilonSpaceWorld.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	EpsilonSpaceWorld.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EpsilonSpaceWorld.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EpsilonSpaceWorld.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
6916	WMIC.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
2576	tasklist.exe
2008	tasklist.exe
1972	tasklist.exe
4276	tasklist.exe
4144	tasklist.exe
4488	tasklist.exe
5384	tasklist.exe
1432	tasklist.exe
2792	tasklist.exe
5048	tasklist.exe
5436	tasklist.exe
2780	tasklist.exe
2616	tasklist.exe
2884	tasklist.exe
2916	tasklist.exe
2232	tasklist.exe
5100	tasklist.exe
5152	tasklist.exe
5308	tasklist.exe
2688	tasklist.exe
2912	tasklist.exe
3140	tasklist.exe
3684	tasklist.exe
3700	tasklist.exe
4336	tasklist.exe
5252	tasklist.exe
5244	tasklist.exe
3028	tasklist.exe
3764	tasklist.exe
5108	tasklist.exe
5088	tasklist.exe
5128	tasklist.exe
5144	tasklist.exe
5224	tasklist.exe
5316	tasklist.exe
4872	tasklist.exe
1972	tasklist.exe
2100	tasklist.exe
1012	tasklist.exe
2252	tasklist.exe
3432	tasklist.exe
3468	tasklist.exe
3608	tasklist.exe
2568	tasklist.exe
3852	tasklist.exe
636	tasklist.exe
2788	tasklist.exe
2756	tasklist.exe
1924	tasklist.exe
3496	tasklist.exe
4364	tasklist.exe
5292	tasklist.exe
1788	tasklist.exe
5164	tasklist.exe
784	tasklist.exe
1608	tasklist.exe
5460	tasklist.exe
3528	tasklist.exe
4576	tasklist.exe
5212	tasklist.exe
5376	tasklist.exe
2740	tasklist.exe
1420	tasklist.exe
1244	tasklist.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2508	EpsilonSpaceWorld.exe
2508	EpsilonSpaceWorld.exe
4344	EpsilonSpaceWorld.exe
4344	EpsilonSpaceWorld.exe
4344	EpsilonSpaceWorld.exe
4344	EpsilonSpaceWorld.exe
4344	EpsilonSpaceWorld.exe
4344	EpsilonSpaceWorld.exe
4344	EpsilonSpaceWorld.exe
4344	EpsilonSpaceWorld.exe
4344	EpsilonSpaceWorld.exe
4344	EpsilonSpaceWorld.exe
4344	EpsilonSpaceWorld.exe
4344	EpsilonSpaceWorld.exe
6996	powershell.exe
6996	powershell.exe
2508	EpsilonSpaceWorld.exe
2508	EpsilonSpaceWorld.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2744	tasklist.exe
Token: SeSecurityPrivilege	2744	tasklist.exe
Token: SeTakeOwnershipPrivilege	2744	tasklist.exe
Token: SeLoadDriverPrivilege	2744	tasklist.exe
Token: SeSystemProfilePrivilege	2744	tasklist.exe
Token: SeSystemtimePrivilege	2744	tasklist.exe
Token: SeProfSingleProcessPrivilege	2744	tasklist.exe
Token: SeIncBasePriorityPrivilege	2744	tasklist.exe
Token: SeCreatePagefilePrivilege	2744	tasklist.exe
Token: SeBackupPrivilege	2744	tasklist.exe
Token: SeRestorePrivilege	2744	tasklist.exe
Token: SeShutdownPrivilege	2744	tasklist.exe
Token: SeDebugPrivilege	2744	tasklist.exe
Token: SeSystemEnvironmentPrivilege	2744	tasklist.exe
Token: SeRemoteShutdownPrivilege	2744	tasklist.exe
Token: SeUndockPrivilege	2744	tasklist.exe
Token: SeManageVolumePrivilege	2744	tasklist.exe
Token: 33	2744	tasklist.exe
Token: 34	2744	tasklist.exe
Token: 35	2744	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2744	tasklist.exe
Token: SeSecurityPrivilege	2744	tasklist.exe
Token: SeTakeOwnershipPrivilege	2744	tasklist.exe
Token: SeLoadDriverPrivilege	2744	tasklist.exe
Token: SeSystemProfilePrivilege	2744	tasklist.exe
Token: SeSystemtimePrivilege	2744	tasklist.exe
Token: SeProfSingleProcessPrivilege	2744	tasklist.exe
Token: SeIncBasePriorityPrivilege	2744	tasklist.exe
Token: SeCreatePagefilePrivilege	2744	tasklist.exe
Token: SeBackupPrivilege	2744	tasklist.exe
Token: SeRestorePrivilege	2744	tasklist.exe
Token: SeShutdownPrivilege	2744	tasklist.exe
Token: SeDebugPrivilege	2744	tasklist.exe
Token: SeSystemEnvironmentPrivilege	2744	tasklist.exe
Token: SeRemoteShutdownPrivilege	2744	tasklist.exe
Token: SeUndockPrivilege	2744	tasklist.exe
Token: SeManageVolumePrivilege	2744	tasklist.exe
Token: 33	2744	tasklist.exe
Token: 34	2744	tasklist.exe
Token: 35	2744	tasklist.exe
Token: SeDebugPrivilege	636	tasklist.exe
Token: SeDebugPrivilege	2100	tasklist.exe
Token: SeDebugPrivilege	2540	tasklist.exe
Token: SeDebugPrivilege	1432	tasklist.exe
Token: SeDebugPrivilege	2568	tasklist.exe
Token: SeDebugPrivilege	2780	tasklist.exe
Token: SeDebugPrivilege	2788	tasklist.exe
Token: SeDebugPrivilege	2576	tasklist.exe
Token: SeDebugPrivilege	2596	tasklist.exe
Token: SeDebugPrivilege	2688	tasklist.exe
Token: SeDebugPrivilege	2640	tasklist.exe
Token: SeDebugPrivilege	2624	tasklist.exe
Token: SeDebugPrivilege	2368	tasklist.exe
Token: SeDebugPrivilege	2792	tasklist.exe
Token: SeDebugPrivilege	2140	tasklist.exe
Token: SeDebugPrivilege	3028	tasklist.exe
Token: SeDebugPrivilege	1788	tasklist.exe
Token: SeDebugPrivilege	2616	tasklist.exe
Token: SeShutdownPrivilege	2508	EpsilonSpaceWorld.exe
Token: SeShutdownPrivilege	2508	EpsilonSpaceWorld.exe
Token: SeDebugPrivilege	2740	tasklist.exe
Token: SeDebugPrivilege	2756	tasklist.exe
Token: SeDebugPrivilege	2008	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2756	2508	EpsilonSpaceWorld.exe	28
PID 2508 wrote to memory of 2756	2508	EpsilonSpaceWorld.exe	28
PID 2508 wrote to memory of 2756	2508	EpsilonSpaceWorld.exe	28
PID 2756 wrote to memory of 1972	2756	cmd.exe	31
PID 2756 wrote to memory of 1972	2756	cmd.exe	31
PID 2756 wrote to memory of 1972	2756	cmd.exe	31
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2808	2508	EpsilonSpaceWorld.exe	30
PID 2508 wrote to memory of 2876	2508	EpsilonSpaceWorld.exe	34
PID 2508 wrote to memory of 2876	2508	EpsilonSpaceWorld.exe	34
PID 2508 wrote to memory of 2876	2508	EpsilonSpaceWorld.exe	34
PID 2876 wrote to memory of 2744	2876	cmd.exe	179
PID 2876 wrote to memory of 2744	2876	cmd.exe	179
PID 2876 wrote to memory of 2744	2876	cmd.exe	179
PID 2508 wrote to memory of 1384	2508	EpsilonSpaceWorld.exe	124
PID 2508 wrote to memory of 1384	2508	EpsilonSpaceWorld.exe	124
PID 2508 wrote to memory of 1384	2508	EpsilonSpaceWorld.exe	124
PID 2508 wrote to memory of 1460	2508	EpsilonSpaceWorld.exe	122
PID 2508 wrote to memory of 1460	2508	EpsilonSpaceWorld.exe	122
PID 2508 wrote to memory of 1460	2508	EpsilonSpaceWorld.exe	122
PID 2508 wrote to memory of 772	2508	EpsilonSpaceWorld.exe	121
PID 2508 wrote to memory of 772	2508	EpsilonSpaceWorld.exe	121
PID 2508 wrote to memory of 772	2508	EpsilonSpaceWorld.exe	121
PID 2508 wrote to memory of 1260	2508	EpsilonSpaceWorld.exe	119
PID 2508 wrote to memory of 1260	2508	EpsilonSpaceWorld.exe	119

C:\Users\Admin\AppData\Local\Temp\EpsilonSpaceWorld.exe
"C:\Users\Admin\AppData\Local\Temp\EpsilonSpaceWorld.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- C:\Users\Admin\AppData\Local\Temp\EpsilonSpaceWorld.exe
  "C:\Users\Admin\AppData\Local\Temp\EpsilonSpaceWorld.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=988 --field-trial-handle=1124,12011693056638590491,15838987256160268299,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=2508 get ExecutablePath"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where processid=2508 get ExecutablePath
    3⤵
    PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:328
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2296
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:340
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1376
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1256
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2184
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2032
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1704
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1228
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2256
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1028
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:2892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2224
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1204
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1056
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2264
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2060
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2544
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1736
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2340
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2384
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1184
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1892
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:3444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:112
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:548
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:2036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2932
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:2276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:960
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:1832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1288
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2120
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1216
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1312
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2084
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2488
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2436
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1592
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1820
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:1560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1852
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2132
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1580
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1644
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1260
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:772
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:660
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2180
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1652
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2812
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2588
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:3756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3016
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1692
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3396
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:3884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3484
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:3916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3580
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3644
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3748
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:4880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3780
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3844
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3860
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3872
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3892
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3908
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3900
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3924
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3932
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3940
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3948
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3956
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3964
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3972
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:4564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3980
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:5204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3992
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4008
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:5196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4024
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4036
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4068
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4088
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3408
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4112
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4120
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:5284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4132
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:5236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4148
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4160
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:5360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4184
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4212
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4220
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4228
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4236
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:5336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4244
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4252
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:5308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:4264
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5420
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\bind\main.exe"
  2⤵
  PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
  2⤵
  PID:4296
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:5368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:4304
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    PID:5516
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:5528
- C:\Users\Admin\AppData\Local\Temp\EpsilonSpaceWorld.exe
  "C:\Users\Admin\AppData\Local\Temp\EpsilonSpaceWorld.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --mojo-platform-channel-handle=1520 --field-trial-handle=1124,12011693056638590491,15838987256160268299,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Users\Admin\AppData\Local\Temp\EpsilonSpaceWorld.exe
  "C:\Users\Admin\AppData\Local\Temp\EpsilonSpaceWorld.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1408 --field-trial-handle=1124,12011693056638590491,15838987256160268299,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:6480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  PID:6724
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:6744
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:6752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  PID:6884
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:6916
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:6928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:6968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6996

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1e2a36dc-943d-48c1-a0bc-0305981fe963.tmp.node

Path \Users\Admin\AppData\Local\Temp\1e2a36dc-943d-48c1-a0bc-0305981fe963.tmp.node
Size 138KB
SHA256 f8d9d9d8f42fd0bd73172f9ed7649e59b24d0a8dbe932a1b1af0035bf78783f8
MD5 a07f2afd83063dcde53e6df838f28b78
SHA1 437dde3257b708203a31cab1f122ee0e1574348c
SHA512 5986f94aa842ea3846488e2183ce30ae74d5f382f3c4595e8397e6d88ea3210f8d01f5b12fbc88881f290124f296b6c371ba9edf3242f8b56eb530df93f26be5
SSDEEP 3072:reYtwfOG5plJqFtCeqKVKlH1ZY7fdL4XJ8:rjwjpTq30KVCVZofd858
MD5 SHA1 SHA512 SSDEEP

Submit Download

e837f857-375e-4e5f-bfcb-66e3065eccd4.tmp.node

Path \Users\Admin\AppData\Local\Temp\e837f857-375e-4e5f-bfcb-66e3065eccd4.tmp.node
Size 663KB
SHA256 9a6cee508604ce369b8409a9cfddf099f19c17cc66632e76fc3870b1f8cb6c79
MD5 ce89533602f74b1368805d323f1cf98c
SHA1 d43b81b8b53a59b9b92b39d17639a30eaf02481a
SHA512 ca3e43a8319b2b89e6da1921117f02ebfadb40d6b1589eda45769181045f6282606e83667961e6c4887d6ab3142d58d260d40d76672d6157c75963c00d822eb2
SSDEEP 6144:8UFDjE/VIV6hKmpaYItaLYV0wBTbjoxBmp3FDsO3oS2C5N+68nZ:LY/Vw6hBIVm0TbjoxeFAOB+68
MD5 SHA1 SHA512 SSDEEP

Submit Download

f68d63f8-e6ce-428a-8b09-9c7c68def0be.tmp.node

Path \Users\Admin\AppData\Local\Temp\f68d63f8-e6ce-428a-8b09-9c7c68def0be.tmp.node
Size 669KB
SHA256 1b134db545e9a5b5845971ad1d90e33fa146f487bd264419dfe7040bcf0fee41
MD5 fe627c3085df9196c976778e0c597884
SHA1 459a9faff0bacf3163a0b0106847ae2ad4088141
SHA512 57411b3ca5324aa9cea4b95457d1f326745350d15d5cb0fed6411a92e92b2591e751f7d2149e308bf4944cd19f12a73facdd6245f2b28159a99325ed33fae027
SSDEEP 12288:B+m+0EppL5UsGqlIuaBcT7VeLVl7M2xfbxvTOmNb8stmFlZE:B+m1EppL5aDBc8V62xfpTOmh8stmFlZE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2808-13-0x0000000000060000-0x0000000000061000-memory.dmp

Download

memory/2808-46-0x0000000077970000-0x0000000077971000-memory.dmp

Download

memory/6996-127-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Download

memory/6996-125-0x0000000001E80000-0x0000000001E88000-memory.dmp

Download

memory/6996-126-0x000007FEF3850000-0x000007FEF41ED000-memory.dmp

Download

memory/6996-123-0x000000001B820000-0x000000001BB02000-memory.dmp

Download

memory/6996-128-0x000007FEF3850000-0x000007FEF41ED000-memory.dmp

Download

memory/6996-129-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Download

memory/6996-130-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Download

memory/6996-131-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Download

memory/6996-205-0x000007FEF3850000-0x000007FEF41ED000-memory.dmp

Download

memory/6996-206-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Download

memory/6996-207-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Download