Overview
overview
8Static
static
3Dead By Daylight.exe
windows7-x64
7Dead By Daylight.exe
windows10-2004-x64
8$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Dead By Daylight.exe
windows7-x64
7Dead By Daylight.exe
windows10-2004-x64
8LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...05.dll
windows7-x64
1resources/...05.dll
windows10-2004-x64
1resources/...am.exe
windows7-x64
1resources/...am.exe
windows10-2004-x64
1resources/...ot.exe
windows7-x64
1resources/...ot.exe
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1Analysis
-
max time kernel
151s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 23:09
Static task
static1
Behavioral task
behavioral1
Sample
Dead By Daylight.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
Dead By Daylight.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Dead By Daylight.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
Dead By Daylight.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
LICENSES.chromium.html
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
LICENSES.chromium.html
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/take-cam/DirectShowLib-2005.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/take-cam/DirectShowLib-2005.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/take-cam/prey-webcam.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/take-cam/prey-webcam.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/take-cam/snapshot.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/take-cam/snapshot.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
resources/elevate.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral25
Sample
resources/elevate.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
swiftshader/libEGL.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral27
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
swiftshader/libGLESv2.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral29
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
vk_swiftshader.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral31
Sample
vk_swiftshader.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
vulkan-1.dll
Resource
win7-20240708-en
windows7-x64
General
-
Target
Dead By Daylight.exe
-
Size
139.5MB
-
MD5
ff7d06a374ffb2bc464f630d478afea1
-
SHA1
ad885e52648932c7cc3ec3ab326e9ab2e7f1bc63
-
SHA256
3041cce487877fedecf1d5a74ae0d7c1f86639d2697d6471071adda3783ed377
-
SHA512
757fcbae74427551981333e709cef14dd17acf342b7897ef3a64844cb2afabeeedb1d82c5befc508a46a4fa2f0764347ec3dc01a2ad81e24506bf8ee2941b181
-
SSDEEP
786432:314w5ThzHwQBgmoLWv+K18nCzKdo5DTdvfMQr6SSmPuvh8tSIW68:314kpHwQjCWv+K18CedmVvEQEpcJW
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1512 Dead By Daylight.exe 1512 Dead By Daylight.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ipinfo.io 5 ipinfo.io 6 ipinfo.io -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 1696 WMIC.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1588 WMIC.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2800 tasklist.exe 2208 tasklist.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1512 Dead By Daylight.exe 1512 Dead By Daylight.exe 2764 Dead By Daylight.exe 1768 powershell.exe 1512 Dead By Daylight.exe 1512 Dead By Daylight.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2800 tasklist.exe Token: SeShutdownPrivilege 1512 Dead By Daylight.exe Token: SeShutdownPrivilege 1512 Dead By Daylight.exe Token: SeIncreaseQuotaPrivilege 2736 WMIC.exe Token: SeSecurityPrivilege 2736 WMIC.exe Token: SeTakeOwnershipPrivilege 2736 WMIC.exe Token: SeLoadDriverPrivilege 2736 WMIC.exe Token: SeSystemProfilePrivilege 2736 WMIC.exe Token: SeSystemtimePrivilege 2736 WMIC.exe Token: SeProfSingleProcessPrivilege 2736 WMIC.exe Token: SeIncBasePriorityPrivilege 2736 WMIC.exe Token: SeCreatePagefilePrivilege 2736 WMIC.exe Token: SeBackupPrivilege 2736 WMIC.exe Token: SeRestorePrivilege 2736 WMIC.exe Token: SeShutdownPrivilege 2736 WMIC.exe Token: SeDebugPrivilege 2736 WMIC.exe Token: SeSystemEnvironmentPrivilege 2736 WMIC.exe Token: SeRemoteShutdownPrivilege 2736 WMIC.exe Token: SeUndockPrivilege 2736 WMIC.exe Token: SeManageVolumePrivilege 2736 WMIC.exe Token: 33 2736 WMIC.exe Token: 34 2736 WMIC.exe Token: 35 2736 WMIC.exe Token: SeIncreaseQuotaPrivilege 2736 WMIC.exe Token: SeSecurityPrivilege 2736 WMIC.exe Token: SeTakeOwnershipPrivilege 2736 WMIC.exe Token: SeLoadDriverPrivilege 2736 WMIC.exe Token: SeSystemProfilePrivilege 2736 WMIC.exe Token: SeSystemtimePrivilege 2736 WMIC.exe Token: SeProfSingleProcessPrivilege 2736 WMIC.exe Token: SeIncBasePriorityPrivilege 2736 WMIC.exe Token: SeCreatePagefilePrivilege 2736 WMIC.exe Token: SeBackupPrivilege 2736 WMIC.exe Token: SeRestorePrivilege 2736 WMIC.exe Token: SeShutdownPrivilege 2736 WMIC.exe Token: SeDebugPrivilege 2736 WMIC.exe Token: SeSystemEnvironmentPrivilege 2736 WMIC.exe Token: SeRemoteShutdownPrivilege 2736 WMIC.exe Token: SeUndockPrivilege 2736 WMIC.exe Token: SeManageVolumePrivilege 2736 WMIC.exe Token: 33 2736 WMIC.exe Token: 34 2736 WMIC.exe Token: 35 2736 WMIC.exe Token: SeShutdownPrivilege 1512 Dead By Daylight.exe Token: SeShutdownPrivilege 1512 Dead By Daylight.exe Token: SeDebugPrivilege 2208 tasklist.exe Token: SeShutdownPrivilege 1512 Dead By Daylight.exe Token: SeShutdownPrivilege 1512 Dead By Daylight.exe Token: SeIncreaseQuotaPrivilege 1696 WMIC.exe Token: SeSecurityPrivilege 1696 WMIC.exe Token: SeTakeOwnershipPrivilege 1696 WMIC.exe Token: SeLoadDriverPrivilege 1696 WMIC.exe Token: SeSystemProfilePrivilege 1696 WMIC.exe Token: SeSystemtimePrivilege 1696 WMIC.exe Token: SeProfSingleProcessPrivilege 1696 WMIC.exe Token: SeIncBasePriorityPrivilege 1696 WMIC.exe Token: SeCreatePagefilePrivilege 1696 WMIC.exe Token: SeBackupPrivilege 1696 WMIC.exe Token: SeRestorePrivilege 1696 WMIC.exe Token: SeShutdownPrivilege 1696 WMIC.exe Token: SeDebugPrivilege 1696 WMIC.exe Token: SeSystemEnvironmentPrivilege 1696 WMIC.exe Token: SeRemoteShutdownPrivilege 1696 WMIC.exe Token: SeUndockPrivilege 1696 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1512 wrote to memory of 2952 1512 Dead By Daylight.exe 30 PID 1512 wrote to memory of 2952 1512 Dead By Daylight.exe 30 PID 1512 wrote to memory of 2952 1512 Dead By Daylight.exe 30 PID 2952 wrote to memory of 2800 2952 cmd.exe 32 PID 2952 wrote to memory of 2800 2952 cmd.exe 32 PID 2952 wrote to memory of 2800 2952 cmd.exe 32 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 2884 1512 Dead By Daylight.exe 33 PID 1512 wrote to memory of 3056 1512 Dead By Daylight.exe 35 PID 1512 wrote to memory of 3056 1512 Dead By Daylight.exe 35 PID 1512 wrote to memory of 3056 1512 Dead By Daylight.exe 35 PID 3056 wrote to memory of 2736 3056 cmd.exe 37 PID 3056 wrote to memory of 2736 3056 cmd.exe 37 PID 3056 wrote to memory of 2736 3056 cmd.exe 37 PID 1512 wrote to memory of 2764 1512 Dead By Daylight.exe 38 PID 1512 wrote to memory of 2764 1512 Dead By Daylight.exe 38 PID 1512 wrote to memory of 2764 1512 Dead By Daylight.exe 38 PID 1512 wrote to memory of 2332 1512 Dead By Daylight.exe 39 PID 1512 wrote to memory of 2332 1512 Dead By Daylight.exe 39 PID 1512 wrote to memory of 2332 1512 Dead By Daylight.exe 39 PID 1512 wrote to memory of 2332 1512 Dead By Daylight.exe 39 PID 1512 wrote to memory of 2332 1512 Dead By Daylight.exe 39 PID 1512 wrote to memory of 2332 1512 Dead By Daylight.exe 39 PID 1512 wrote to memory of 2332 1512 Dead By Daylight.exe 39 PID 1512 wrote to memory of 2332 1512 Dead By Daylight.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe"C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
-
C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe"C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=964 --field-trial-handle=1132,17106366604729532912,13815522264818183549,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=NaN get ExecutablePath"2⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\System32\Wbem\WMIC.exewmic process where processid=NaN get ExecutablePath3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
-
C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe"C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --mojo-platform-channel-handle=1020 --field-trial-handle=1132,17106366604729532912,13815522264818183549,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe"C:\Users\Admin\AppData\Local\Temp\Dead By Daylight.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\script" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1424 --field-trial-handle=1132,17106366604729532912,13815522264818183549,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2332
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2200
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵PID:2244
-
C:\Windows\system32\net.exenet session3⤵PID:400
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵PID:2428
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\bind\main.exe"2⤵PID:1912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk get size"2⤵PID:2424
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get size3⤵
- Collects information from the system
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get totalphysicalmemory | more +1"2⤵PID:1368
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory3⤵PID:940
-
-
C:\Windows\system32\more.commore +13⤵PID:2432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"2⤵PID:656
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid3⤵PID:784
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %NUMBER_OF_PROCESSORS%"2⤵PID:608
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"2⤵PID:1280
-
C:\Windows\System32\Wbem\WMIC.exewmic OS get caption, osarchitecture3⤵PID:2604
-
-
C:\Windows\system32\more.commore +13⤵PID:1828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"2⤵PID:756
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:2592
-
-
C:\Windows\system32\more.commore +13⤵PID:2012
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"2⤵PID:2632
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController get name3⤵
- Detects videocard installed
PID:1588
-
-
C:\Windows\system32\more.commore +13⤵PID:672
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"2⤵PID:2644
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1768
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD53072b68e3c226aff39e6782d025f25a8
SHA1cf559196d74fa490ac8ce192db222c9f5c5a006a
SHA2567fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01
SHA51261ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61
-
Filesize
643KB
MD57bb446b26e6da42fa1bf16e4aec09a5d
SHA1508aabc385972640a47b22ee81eb075b824a04b5
SHA25690be01ac92e77ed27c88b8b3a4472f24ffdb11bdce4141ffa8ec556600874049
SHA512d0bcfd7bd071348e8350e8251003386abd40a15a6b4c21003cf76f084e88b9ab4df8776e0401cebebd8f29790e538266c2ee4c2258fd2ef99d358d3e9007c1ca