Overview
overview
7Static
static
3HS Loader.exe
windows10-2004-x64
7HS Loader.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
3$PLUGINSDIR/app-64.7z
windows11-21h2-x64
3HS Loader.exe
windows10-2004-x64
7HS Loader.exe
windows11-21h2-x64
7LICENSE.electron.txt
windows10-2004-x64
1LICENSE.electron.txt
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
1LICENSES.c...m.html
windows11-21h2-x64
1d3dcompiler_47.dll
windows10-2004-x64
1d3dcompiler_47.dll
windows11-21h2-x64
1ffmpeg.dll
windows10-2004-x64
1ffmpeg.dll
windows11-21h2-x64
1libEGL.dll
windows10-2004-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows10-2004-x64
1libGLESv2.dll
windows11-21h2-x64
1resources/elevate.exe
windows10-2004-x64
1resources/elevate.exe
windows11-21h2-x64
1vk_swiftshader.dll
windows10-2004-x64
1vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows10-2004-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
-
max time kernel
1200s -
max time network
1175s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 02:47
Static task
static1
Behavioral task
behavioral1
Sample
HS Loader.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
HS Loader.exe
Resource
win11-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240419-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/app-64.7z
Resource
win11-20240419-en
Behavioral task
behavioral9
Sample
HS Loader.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
HS Loader.exe
Resource
win11-20240426-en
Behavioral task
behavioral11
Sample
LICENSE.electron.txt
Resource
win10v2004-20240419-en
Behavioral task
behavioral12
Sample
LICENSE.electron.txt
Resource
win11-20240426-en
Behavioral task
behavioral13
Sample
LICENSES.chromium.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
LICENSES.chromium.html
Resource
win11-20240426-en
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
d3dcompiler_47.dll
Resource
win11-20240426-en
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral18
Sample
ffmpeg.dll
Resource
win11-20240419-en
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral20
Sample
libEGL.dll
Resource
win11-20240419-en
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral22
Sample
libGLESv2.dll
Resource
win11-20240419-en
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral24
Sample
resources/elevate.exe
Resource
win11-20240419-en
Behavioral task
behavioral25
Sample
vk_swiftshader.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
vk_swiftshader.dll
Resource
win11-20240426-en
Behavioral task
behavioral27
Sample
vulkan-1.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral28
Sample
vulkan-1.dll
Resource
win11-20240419-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20240426-en
General
-
Target
HS Loader.exe
-
Size
164.7MB
-
MD5
40b3c1a407ec95f5fbc79f047215e5da
-
SHA1
30c4b04be35c589cdd89392142d595a6092ac010
-
SHA256
c580316aa6c2fc57b218afc93e4b8c457acfad0f25780a23ae2778135ad8cc8d
-
SHA512
1dd653f12f2482200578a11fee42150ee0043bc41038a9cb1bf13f0e2102a4f1eccc9e4b7e841a35e3affa09103c9505f5ea57ca82b3c4443f66fdd34c31439a
-
SSDEEP
1572864:9tc2cEGwGrRSREICCr3ka8YrcSAfII01aLadS5sDNd+Ipx9cF3LfxNEK2Ho8jlgY:j+CHrJIgIsV
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 412 HS Loader.exe 412 HS Loader.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 ipinfo.io 14 ipinfo.io -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF HS Loader.exe File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF HS Loader.exe -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 HS Loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz HS Loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString HS Loader.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 HS Loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz HS Loader.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString HS Loader.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 HS Loader.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 10752 WMIC.exe -
Enumerates processes with tasklist 1 TTPs 64 IoCs
pid Process 8344 tasklist.exe 7860 tasklist.exe 7204 tasklist.exe 7196 tasklist.exe 7384 tasklist.exe 7512 tasklist.exe 7504 tasklist.exe 7772 tasklist.exe 7692 tasklist.exe 7400 tasklist.exe 7572 tasklist.exe 8312 tasklist.exe 8100 tasklist.exe 7844 tasklist.exe 8164 tasklist.exe 8084 tasklist.exe 11204 tasklist.exe 7308 tasklist.exe 7412 tasklist.exe 7544 tasklist.exe 7852 tasklist.exe 7700 tasklist.exe 7732 tasklist.exe 7620 tasklist.exe 7300 tasklist.exe 7480 tasklist.exe 7596 tasklist.exe 7536 tasklist.exe 7892 tasklist.exe 8052 tasklist.exe 7984 tasklist.exe 7812 tasklist.exe 6884 tasklist.exe 7364 tasklist.exe 7236 tasklist.exe 7220 tasklist.exe 7212 tasklist.exe 7564 tasklist.exe 7432 tasklist.exe 8036 tasklist.exe 7644 tasklist.exe 8028 tasklist.exe 7940 tasklist.exe 4376 tasklist.exe 7332 tasklist.exe 7292 tasklist.exe 7252 tasklist.exe 7148 tasklist.exe 7456 tasklist.exe 8044 tasklist.exe 7956 tasklist.exe 7056 tasklist.exe 7356 tasklist.exe 7228 tasklist.exe 7448 tasklist.exe 8352 tasklist.exe 8232 tasklist.exe 7340 tasklist.exe 7316 tasklist.exe 7524 tasklist.exe 8292 tasklist.exe 8284 tasklist.exe 8196 tasklist.exe 6872 tasklist.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 412 HS Loader.exe 412 HS Loader.exe 412 HS Loader.exe 412 HS Loader.exe 412 HS Loader.exe 412 HS Loader.exe 10844 powershell.exe 10844 powershell.exe 10844 powershell.exe 11032 powershell.exe 11032 powershell.exe 11032 powershell.exe 5340 HS Loader.exe 5340 HS Loader.exe 5340 HS Loader.exe 5340 HS Loader.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4376 tasklist.exe Token: SeShutdownPrivilege 412 HS Loader.exe Token: SeCreatePagefilePrivilege 412 HS Loader.exe Token: SeIncreaseQuotaPrivilege 4140 WMIC.exe Token: SeSecurityPrivilege 4140 WMIC.exe Token: SeTakeOwnershipPrivilege 4140 WMIC.exe Token: SeLoadDriverPrivilege 4140 WMIC.exe Token: SeSystemProfilePrivilege 4140 WMIC.exe Token: SeSystemtimePrivilege 4140 WMIC.exe Token: SeProfSingleProcessPrivilege 4140 WMIC.exe Token: SeIncBasePriorityPrivilege 4140 WMIC.exe Token: SeCreatePagefilePrivilege 4140 WMIC.exe Token: SeBackupPrivilege 4140 WMIC.exe Token: SeRestorePrivilege 4140 WMIC.exe Token: SeShutdownPrivilege 4140 WMIC.exe Token: SeDebugPrivilege 4140 WMIC.exe Token: SeSystemEnvironmentPrivilege 4140 WMIC.exe Token: SeRemoteShutdownPrivilege 4140 WMIC.exe Token: SeUndockPrivilege 4140 WMIC.exe Token: SeManageVolumePrivilege 4140 WMIC.exe Token: 33 4140 WMIC.exe Token: 34 4140 WMIC.exe Token: 35 4140 WMIC.exe Token: 36 4140 WMIC.exe Token: SeIncreaseQuotaPrivilege 4140 WMIC.exe Token: SeSecurityPrivilege 4140 WMIC.exe Token: SeTakeOwnershipPrivilege 4140 WMIC.exe Token: SeLoadDriverPrivilege 4140 WMIC.exe Token: SeSystemProfilePrivilege 4140 WMIC.exe Token: SeSystemtimePrivilege 4140 WMIC.exe Token: SeProfSingleProcessPrivilege 4140 WMIC.exe Token: SeIncBasePriorityPrivilege 4140 WMIC.exe Token: SeCreatePagefilePrivilege 4140 WMIC.exe Token: SeBackupPrivilege 4140 WMIC.exe Token: SeRestorePrivilege 4140 WMIC.exe Token: SeShutdownPrivilege 4140 WMIC.exe Token: SeDebugPrivilege 4140 WMIC.exe Token: SeSystemEnvironmentPrivilege 4140 WMIC.exe Token: SeRemoteShutdownPrivilege 4140 WMIC.exe Token: SeUndockPrivilege 4140 WMIC.exe Token: SeManageVolumePrivilege 4140 WMIC.exe Token: 33 4140 WMIC.exe Token: 34 4140 WMIC.exe Token: 35 4140 WMIC.exe Token: 36 4140 WMIC.exe Token: SeShutdownPrivilege 412 HS Loader.exe Token: SeCreatePagefilePrivilege 412 HS Loader.exe Token: SeDebugPrivilege 6884 tasklist.exe Token: SeDebugPrivilege 6872 tasklist.exe Token: SeDebugPrivilege 7204 tasklist.exe Token: SeDebugPrivilege 7316 tasklist.exe Token: SeDebugPrivilege 7392 tasklist.exe Token: SeDebugPrivilege 7064 tasklist.exe Token: SeDebugPrivilege 6048 tasklist.exe Token: SeDebugPrivilege 7148 tasklist.exe Token: SeDebugPrivilege 7348 tasklist.exe Token: SeDebugPrivilege 7056 tasklist.exe Token: SeDebugPrivilege 7212 tasklist.exe Token: SeDebugPrivilege 7072 tasklist.exe Token: SeDebugPrivilege 7384 tasklist.exe Token: SeDebugPrivilege 7236 tasklist.exe Token: SeDebugPrivilege 7268 tasklist.exe Token: SeDebugPrivilege 7300 tasklist.exe Token: SeDebugPrivilege 7292 tasklist.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 412 wrote to memory of 2012 412 HS Loader.exe 81 PID 412 wrote to memory of 2012 412 HS Loader.exe 81 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 2308 412 HS Loader.exe 83 PID 412 wrote to memory of 1264 412 HS Loader.exe 84 PID 412 wrote to memory of 1264 412 HS Loader.exe 84 PID 2012 wrote to memory of 4376 2012 cmd.exe 85 PID 2012 wrote to memory of 4376 2012 cmd.exe 85 PID 412 wrote to memory of 2916 412 HS Loader.exe 87 PID 412 wrote to memory of 2916 412 HS Loader.exe 87 PID 2916 wrote to memory of 4140 2916 cmd.exe 89 PID 2916 wrote to memory of 4140 2916 cmd.exe 89 PID 412 wrote to memory of 3016 412 HS Loader.exe 90 PID 412 wrote to memory of 3016 412 HS Loader.exe 90 PID 412 wrote to memory of 3816 412 HS Loader.exe 92 PID 412 wrote to memory of 3816 412 HS Loader.exe 92 PID 412 wrote to memory of 4396 412 HS Loader.exe 93 PID 412 wrote to memory of 4396 412 HS Loader.exe 93 PID 412 wrote to memory of 3268 412 HS Loader.exe 94 PID 412 wrote to memory of 3268 412 HS Loader.exe 94 PID 412 wrote to memory of 4552 412 HS Loader.exe 95 PID 412 wrote to memory of 4552 412 HS Loader.exe 95 PID 412 wrote to memory of 2544 412 HS Loader.exe 96 PID 412 wrote to memory of 2544 412 HS Loader.exe 96 PID 412 wrote to memory of 2288 412 HS Loader.exe 97 PID 412 wrote to memory of 2288 412 HS Loader.exe 97 PID 412 wrote to memory of 3976 412 HS Loader.exe 98 PID 412 wrote to memory of 3976 412 HS Loader.exe 98 PID 412 wrote to memory of 3968 412 HS Loader.exe 99 PID 412 wrote to memory of 3968 412 HS Loader.exe 99 PID 412 wrote to memory of 4504 412 HS Loader.exe 101 PID 412 wrote to memory of 4504 412 HS Loader.exe 101 PID 412 wrote to memory of 3412 412 HS Loader.exe 102 PID 412 wrote to memory of 3412 412 HS Loader.exe 102 PID 412 wrote to memory of 1936 412 HS Loader.exe 104 PID 412 wrote to memory of 1936 412 HS Loader.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\HS Loader.exe"C:\Users\Admin\AppData\Local\Temp\HS Loader.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
-
-
C:\Users\Admin\AppData\Local\Temp\HS Loader.exe"C:\Users\Admin\AppData\Local\Temp\HS Loader.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\theonlyscript" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1700 --field-trial-handle=1316,i,161538281062729697,4854124768174049425,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2308
-
-
C:\Users\Admin\AppData\Local\Temp\HS Loader.exe"C:\Users\Admin\AppData\Local\Temp\HS Loader.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\theonlyscript" --mojo-platform-channel-handle=1912 --field-trial-handle=1316,i,161538281062729697,4854124768174049425,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵PID:1264
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"2⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\System32\Wbem\WMIC.exewmic process where processid=NaN get ExecutablePath3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4140
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3016
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Suspicious use of AdjustPrivilegeToken
PID:7064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3816
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:6872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4396
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7056
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3268
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7644
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4552
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7364
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2544
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Suspicious use of AdjustPrivilegeToken
PID:7072
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2288
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:6884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3976
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Suspicious use of AdjustPrivilegeToken
PID:7348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3968
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4504
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3412
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7580
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1936
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4992
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Suspicious use of AdjustPrivilegeToken
PID:7392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2264
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7276
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2336
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:8100
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1172
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3416
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Suspicious use of AdjustPrivilegeToken
PID:7268
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4428
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2428
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7292
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2024
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4276
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3872
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:772
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7356
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2972
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7804
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:732
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7196
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1108
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:8060
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2852
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4604
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1732
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7140
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2072
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:8180
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:400
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7812
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3020
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3308
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7332
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1452
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3628
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2476
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7244
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2756
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:212
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:8084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2652
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2856
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7544
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3928
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7204
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1092
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3368
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1388
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:8092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4872
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7308
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3408
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7732
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4560
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7504
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3616
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3396
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:8028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1968
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:8164
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2996
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:8352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4740
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:8044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2400
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:752
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2732
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7456
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3764
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7340
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2168
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4004
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7520
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2256
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7252
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4968
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7572
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2940
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7524
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1164
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7472
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:428
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7608
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3112
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:8196
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5048
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7892
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5004
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:8068
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1448
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:776
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7940
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1632
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:8312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3996
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7932
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4976
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5112
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3788
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7852
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3576
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7692
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:620
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:7316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1528
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:8052
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4340
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:8036
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4508
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:8344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4128
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:8292
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3660
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:8232
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3896
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7672
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4924
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:8260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2608
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:8284
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1176
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:8268
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4608
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:8136
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2012
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7700
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5104
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2364
-
C:\Windows\system32\tasklist.exetasklist3⤵PID:7880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4160
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7860
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2648
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4672
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2908
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:7844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵PID:4876
-
C:\Windows\system32\net.exenet session3⤵PID:7976
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵PID:8376
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\bind\main.exe"2⤵PID:1276
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"2⤵PID:1536
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid3⤵PID:7324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"2⤵PID:5140
-
C:\Windows\System32\Wbem\WMIC.exewmic OS get caption, osarchitecture3⤵PID:7708
-
-
C:\Windows\system32\more.commore +13⤵PID:8240
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"2⤵PID:10608
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:10652
-
-
C:\Windows\system32\more.commore +13⤵PID:10660
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"2⤵PID:10712
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController get name3⤵
- Detects videocard installed
PID:10752
-
-
C:\Windows\system32\more.commore +13⤵PID:10760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"2⤵PID:10804
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault3⤵
- Suspicious behavior: EnumeratesProcesses
PID:10844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"2⤵PID:10992
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:11032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:11164
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:11204
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"2⤵PID:10648
-
C:\Windows\System32\Wbem\WMIC.exewmic process where processid=NaN get ExecutablePath3⤵PID:10796
-
-
-
C:\Users\Admin\AppData\Local\Temp\HS Loader.exe"C:\Users\Admin\AppData\Local\Temp\HS Loader.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\theonlyscript" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2568 --field-trial-handle=1316,i,161538281062729697,4854124768174049425,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
Filesize
64B
MD55caad758326454b5788ec35315c4c304
SHA13aef8dba8042662a7fcf97e51047dc636b4d4724
SHA25683e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA5124e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
-
Filesize
1.4MB
MD556192831a7f808874207ba593f464415
SHA1e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA2566aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33
-
Filesize
151KB
MD5cced65f76596bd833c8b7decc7ecc648
SHA1cb0acdb5377579957f8cfcee4d5b721a63690bd8
SHA256d43138ef3cb7ca53e2936e5b5547ed8e9e79cbbb66cf70d5c08796cb6ed7c913
SHA5128c75405c09a188ab191ed99582661ecdd9d8548cd94af103c3ccc88cf3279cdae670336c7371c5ad96190d727c30b91845d2ec23193ef879ef81424fa00c2f5c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82