Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 11:46
Static task
static1
Behavioral task
behavioral1
Sample
6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe
Resource
win7-20240221-en
General
-
Target
6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe
-
Size
549KB
-
MD5
d3d15e62d61981e85ae81ad54bd23b40
-
SHA1
053d987ff528964bf18ffc1898acd678b8917dd7
-
SHA256
6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79
-
SHA512
e3aded35c8474602e7ec556efdf2626a4d58f1b031c1eedbaf0f0c017c33eed607d3913138af52e8c8e408b75533a0e7ed4a5c3f139491fe2e68cd5ba78e3ad8
-
SSDEEP
12288:CTgeIIGY8gGy4QmKrCc6XJvQOR9DHlXQeAs:OgeGYgyNrCc6ZvhDHlXV
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exedescription ioc process File opened (read-only) \??\h: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\j: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\o: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\q: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\y: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\b: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\m: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\u: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\w: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\g: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\k: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\l: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\n: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\r: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\t: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\v: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\e: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\i: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\p: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\s: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\x: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\z: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe File opened (read-only) \??\a: 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe -
AutoIT Executable 21 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4560-9-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-10-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-12-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-14-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-15-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-21-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-25-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-29-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-34-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-33-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-45-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-49-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-53-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-55-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-57-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-61-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-65-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-66-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-69-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-73-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4560-87-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exedescription pid process target process PID 1580 set thread context of 4560 1580 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exedescription pid process Token: SeDebugPrivilege 1580 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exedescription pid process target process PID 1580 wrote to memory of 4560 1580 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 1580 wrote to memory of 4560 1580 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 1580 wrote to memory of 4560 1580 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 1580 wrote to memory of 4560 1580 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 1580 wrote to memory of 4560 1580 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 1580 wrote to memory of 4560 1580 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 1580 wrote to memory of 4560 1580 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 1580 wrote to memory of 4560 1580 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 1580 wrote to memory of 4560 1580 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 1580 wrote to memory of 4560 1580 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe PID 4560 wrote to memory of 232 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 232 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 232 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4836 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4836 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4836 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 5044 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 5044 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 5044 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 3772 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 3772 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 3772 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 2252 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 2252 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 2252 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1596 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1596 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1596 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4532 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4532 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4532 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 2892 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 2892 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 2892 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 2980 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 2980 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 2980 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4236 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4236 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4236 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1748 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1748 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1748 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4920 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4920 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4920 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1204 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1204 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1204 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 2536 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 2536 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 2536 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1632 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1632 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1632 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4240 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4240 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4240 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1168 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1168 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 1168 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4876 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4876 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe PID 4560 wrote to memory of 4876 4560 6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe"C:\Users\Admin\AppData\Local\Temp\6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exeC:\Users\Admin\AppData\Local\Temp\6ee2fd3994acdbb9a1b1680ccd3ac4b7dcb077b30b44c8677252202a03dccf79.exe2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A3⤵PID:232
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A3⤵PID:4836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A3⤵PID:5044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A3⤵PID:3772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A3⤵PID:2252
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A3⤵PID:1596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A3⤵PID:4532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A3⤵PID:2892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A3⤵PID:2980
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A3⤵PID:4236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A3⤵PID:1748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A3⤵PID:4920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A3⤵PID:1204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A3⤵PID:2536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A3⤵PID:1632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A3⤵PID:4240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A3⤵PID:1168
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.txt" /S /B /A3⤵PID:4876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1580-13-0x0000000074920000-0x00000000750D0000-memory.dmpFilesize
7.7MB
-
memory/1580-0-0x0000000000910000-0x000000000099E000-memory.dmpFilesize
568KB
-
memory/1580-2-0x00000000059E0000-0x0000000005F84000-memory.dmpFilesize
5.6MB
-
memory/1580-3-0x0000000005380000-0x0000000005412000-memory.dmpFilesize
584KB
-
memory/1580-4-0x00000000054E0000-0x00000000054F0000-memory.dmpFilesize
64KB
-
memory/1580-5-0x00000000054F0000-0x0000000005566000-memory.dmpFilesize
472KB
-
memory/1580-6-0x0000000005450000-0x000000000545A000-memory.dmpFilesize
40KB
-
memory/1580-7-0x0000000005660000-0x000000000567E000-memory.dmpFilesize
120KB
-
memory/1580-8-0x00000000056A0000-0x00000000056AE000-memory.dmpFilesize
56KB
-
memory/1580-1-0x0000000074920000-0x00000000750D0000-memory.dmpFilesize
7.7MB
-
memory/4560-15-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-49-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-12-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-14-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-9-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-21-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-25-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-29-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-34-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-33-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-45-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-10-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-53-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-55-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-57-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-61-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-65-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-66-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-69-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-73-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4560-87-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB