Analysis

  • max time kernel
    117s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    16/11/2023, 08:13

General

  • Target

    gatherNetworkInfo.vbs

  • Size

    39KB

  • MD5

    2ae808cb0d9a667b0cf41ea74b3b9bac

  • SHA1

    628b6b4bf3cc7f77578cf3ccfcc587dbf9ec7e07

  • SHA256

    a873a7d3b90c6f2d156e5026b72a5652d4893081cd188300141a95dc38cba56b

  • SHA512

    667e1d082658b36cf7d8cae68d6055a51599d7d411fd5615f1431e15a0d30f267f6447b575bebc034ac7e9b77a1b478c3718801f9848945140be4ee979bc8bff

  • SSDEEP

    768:8IYHILRGUJX4mlrU5R/A+Tr/GsfpkgKo9kNxyJ4OORfWXyB22rQeWE5TloYL7TBY:8IYHILRGUJImlrc/A+3fpkgKo9kNxyJt

Score
8/10

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 8 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs net.exe
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\gatherNetworkInfo.vbs"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\Notifications" Reg\Notif.reg.txt /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1340
      • C:\Windows\system32\reg.exe
        reg export "HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\Notifications" Reg\Notif.reg.txt /y
        3⤵
          PID:2692
        • C:\Windows\system32\certutil.exe
          certutil -v -store -silent My
          3⤵
            PID:2844
            • C:\Windows\system32\wevtutil.exe
              wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose" config\WindowsFirewallConsecLogVerbose.evtx
              4⤵
                PID:2716
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers" Reg\AllCred.reg.txt /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2816
            • C:\Windows\system32\reg.exe
              reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers" Reg\AllCred.reg.txt /y
              3⤵
                PID:2668
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters" Reg\AllCredFilter.reg.txt /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2696
              • C:\Windows\system32\reg.exe
                reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters" Reg\AllCredFilter.reg.txt /y
                3⤵
                  PID:2840
                • C:\Windows\system32\netsh.exe
                  netsh winsock show catalog
                  3⤵
                    PID:2700
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{07AA0886-CC8D-4e19-A410-1C75AF686E62}" Reg\{07AA0886-CC8D-4e19-A410-1C75AF686E62}.reg.txt /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2920
                  • C:\Windows\system32\reg.exe
                    reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{07AA0886-CC8D-4e19-A410-1C75AF686E62}" Reg\{07AA0886-CC8D-4e19-A410-1C75AF686E62}.reg.txt /y
                    3⤵
                      PID:2732
                      • C:\Windows\system32\sc.exe
                        sc query wlansvc
                        4⤵
                        • Launches sc.exe
                        PID:2640
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{33c86cd6-705f-4ba1-9adb-67070b837775}" Reg\{33c86cd6-705f-4ba1-9adb-67070b837775}.reg.txt /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2620
                    • C:\Windows\system32\reg.exe
                      reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{33c86cd6-705f-4ba1-9adb-67070b837775}" Reg\{33c86cd6-705f-4ba1-9adb-67070b837775}.reg.txt /y
                      3⤵
                        PID:2584
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{edd749de-2ef1-4a80-98d1-81f20e6df58e}" Reg\{edd749de-2ef1-4a80-98d1-81f20e6df58e}.reg.txt /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2608
                      • C:\Windows\system32\reg.exe
                        reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{edd749de-2ef1-4a80-98d1-81f20e6df58e}" Reg\{edd749de-2ef1-4a80-98d1-81f20e6df58e}.reg.txt /y
                        3⤵
                          PID:1352
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters\WlanAPIPermissions" Reg\APIPerm.reg.txt /y
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3060
                        • C:\Windows\system32\reg.exe
                          reg export "HKLM\SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters\WlanAPIPermissions" Reg\APIPerm.reg.txt /y
                          3⤵
                            PID:2492
                            • C:\Windows\system32\netsh.exe
                              netsh advfirewall monitor show currentprofile
                              4⤵
                              • Modifies Windows Firewall
                              PID:1816
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\Wireless\GPTWirelessPolicy" Reg\GPT.reg.txt /y
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3044
                          • C:\Windows\system32\reg.exe
                            reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\Wireless\GPTWirelessPolicy" Reg\GPT.reg.txt /y
                            3⤵
                              PID:1988
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c reg export "HKCU\SOFTWARE\Microsoft\Wlansvc" Reg\HKCUWlanSvc.reg.txt /y
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2756
                            • C:\Windows\system32\reg.exe
                              reg export "HKCU\SOFTWARE\Microsoft\Wlansvc" Reg\HKCUWlanSvc.reg.txt /y
                              3⤵
                                PID:2864
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Microsoft\Wlansvc" Reg\HKLMWlanSvc.reg.txt /y
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2664
                              • C:\Windows\system32\reg.exe
                                reg export "HKLM\SOFTWARE\Microsoft\Wlansvc" Reg\HKLMWlanSvc.reg.txt /y
                                3⤵
                                  PID:528
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Microsoft\dot3svc" Reg\HKLMDot3Svc.reg.txt /y
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2912
                                • C:\Windows\system32\reg.exe
                                  reg export "HKLM\SOFTWARE\Microsoft\dot3svc" Reg\HKLMDot3Svc.reg.txt /y
                                  3⤵
                                    PID:2924
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c reg export "HKCU\SOFTWARE\Microsoft\dot3svc" Reg\HKCUDot3Svc.reg.txt /y
                                  2⤵
                                    PID:3024
                                    • C:\Windows\system32\reg.exe
                                      reg export "HKCU\SOFTWARE\Microsoft\dot3svc" Reg\HKCUDot3Svc.reg.txt /y
                                      3⤵
                                        PID:1900
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\WiredL2\GP_Policy" Reg\L2GP.reg.txt /y
                                      2⤵
                                        PID:1616
                                        • C:\Windows\system32\reg.exe
                                          reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\WiredL2\GP_Policy" Reg\L2GP.reg.txt /y
                                          3⤵
                                            PID:1904
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\NetworkList" Reg\NetworkProfiles.reg.txt /y
                                          2⤵
                                            PID:2028
                                            • C:\Windows\system32\reg.exe
                                              reg export "HKLM\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\NetworkList" Reg\NetworkProfiles.reg.txt /y
                                              3⤵
                                                PID:1964
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c set processor >> config\osinfo.txt
                                              2⤵
                                                PID:1952
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c systeminfo >> config\osinfo.txt
                                                2⤵
                                                  PID:2300
                                                  • C:\Windows\system32\systeminfo.exe
                                                    systeminfo
                                                    3⤵
                                                    • Gathers system information
                                                    PID:2248
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c set u >> config\osinfo.txt
                                                  2⤵
                                                    PID:1928
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c tasklist > tempfile.txt
                                                    2⤵
                                                      PID:552
                                                      • C:\Windows\system32\tasklist.exe
                                                        tasklist
                                                        3⤵
                                                        • Enumerates processes with tasklist
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2252
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c wevtutil epl "Microsoft-Windows-WLAN-AutoConfig/Operational" config\WLANAutoConfigLog.evtx
                                                      2⤵
                                                        PID:1088
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c wevtutil al config\WLANAutoConfigLog.evtx
                                                        2⤵
                                                          PID:1044
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c netsh wlan show all > config\envinfo.txt
                                                          2⤵
                                                            PID:1540
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c netsh lan show profiles >> config\envinfo.txt
                                                            2⤵
                                                              PID:1696
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /c echo ROUTE PRINT: >> config\envinfo.txt
                                                              2⤵
                                                                PID:1936
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c route print >> config\envinfo.txt
                                                                2⤵
                                                                  PID:1592
                                                                  • C:\Windows\system32\ROUTE.EXE
                                                                    route print
                                                                    3⤵
                                                                      PID:2780
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c certutil -v -store -silent My >> config\envinfo.txt
                                                                    2⤵
                                                                      PID:1340
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /c netsh winsock show catalog > config\WinsockCatalog.txt
                                                                      2⤵
                                                                        PID:2696
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c certutil -v -store -silent -user My >> config\envinfo.txt
                                                                        2⤵
                                                                          PID:2812
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c echo Current Profiles: > config\WindowsFirewallConfig.txt
                                                                          2⤵
                                                                            PID:2564
                                                                            • C:\Windows\system32\sc.exe
                                                                              sc query eaphost
                                                                              3⤵
                                                                              • Launches sc.exe
                                                                              PID:2636
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /c netsh advfirewall monitor show currentprofile >> config\WindowsFirewallConfig.txt
                                                                            2⤵
                                                                              PID:2492
                                                                              • C:\Windows\system32\sc.exe
                                                                                sc query upnphost
                                                                                3⤵
                                                                                • Launches sc.exe
                                                                                PID:2864
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /c netsh advfirewall monitor show firewall >> config\WindowsFirewallConfig.txt
                                                                              2⤵
                                                                                PID:548
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c netsh advfirewall monitor show consec >> config\WindowsFirewallConfig.txt
                                                                                2⤵
                                                                                  PID:1348
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /c echo Firewall Rules : >> config\WindowsFirewallConfig.txt
                                                                                  2⤵
                                                                                    PID:2356
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallConfig.txt
                                                                                    2⤵
                                                                                      PID:600
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /c netsh advfirewall consec show rule name=all verbose >> config\WindowsFirewallConfig.txt
                                                                                      2⤵
                                                                                        PID:1864
                                                                                        • C:\Windows\system32\netsh.exe
                                                                                          netsh advfirewall consec show rule name=all verbose
                                                                                          3⤵
                                                                                          • Modifies Windows Firewall
                                                                                          PID:2236
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c netsh advfirewall monitor show firewall rule name=all >> config\WindowsFirewallEffectiveRules.txt
                                                                                        2⤵
                                                                                          PID:940
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallEffectiveRules.txt
                                                                                          2⤵
                                                                                            PID:2272
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c netsh advfirewall monitor show consec rule name=all >> config\WindowsFirewallEffectiveRules.txt
                                                                                            2⤵
                                                                                              PID:2440
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" config\WindowsFirewallLog.evtx
                                                                                              2⤵
                                                                                                PID:2224
                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                  wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" config\WindowsFirewallLog.evtx
                                                                                                  3⤵
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:2200
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /c wevtutil al config\WindowsFirewallLog.evtx
                                                                                                2⤵
                                                                                                  PID:2280
                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                    wevtutil al config\WindowsFirewallLog.evtx
                                                                                                    3⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:368
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c echo Connection Security Rules currently enforced : >> config\WindowsFirewallEffectiveRules.txt
                                                                                                  2⤵
                                                                                                    PID:1084
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallEffectiveRules.txt
                                                                                                    2⤵
                                                                                                      PID:2744
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c echo Firewall Rules currently enforced : > config\WindowsFirewallEffectiveRules.txt
                                                                                                      2⤵
                                                                                                        PID:1420
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity" config\WindowsFirewallConsecLog.evtx
                                                                                                        2⤵
                                                                                                          PID:1176
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /c wevtutil al config\WindowsFirewallConsecLog.evtx
                                                                                                          2⤵
                                                                                                            PID:1956
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c echo Connection Security Rules : >> config\WindowsFirewallConfig.txt
                                                                                                            2⤵
                                                                                                              PID:1928
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose" config\WindowsFirewallLogVerbose.evtx
                                                                                                              2⤵
                                                                                                                PID:2776
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c wevtutil al config\WindowsFirewallLogVerbose.evtx
                                                                                                                2⤵
                                                                                                                  PID:2764
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose" config\WindowsFirewallConsecLogVerbose.evtx
                                                                                                                  2⤵
                                                                                                                    PID:2844
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /c wevtutil al config\WindowsFirewallConsecLogVerbose.evtx
                                                                                                                    2⤵
                                                                                                                      PID:2768
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /c sc query fdrespub >> config\WcnInfo.txt
                                                                                                                      2⤵
                                                                                                                        PID:3040
                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                          sc query fdrespub
                                                                                                                          3⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:1324
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /c sc query eaphost >> config\WcnInfo.txt
                                                                                                                        2⤵
                                                                                                                          PID:2872
                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                            sc query eaphost
                                                                                                                            3⤵
                                                                                                                            • Launches sc.exe
                                                                                                                            PID:664
                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /c sc query upnphost >> config\WcnInfo.txt
                                                                                                                          2⤵
                                                                                                                            PID:2492
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c sc query eaphost >> config\WcnInfo.txt
                                                                                                                            2⤵
                                                                                                                              PID:2564
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /c sc query wlansvc >> config\WcnInfo.txt
                                                                                                                              2⤵
                                                                                                                                PID:2732
                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /c sc query wcncsvc >> config\WcnInfo.txt
                                                                                                                                2⤵
                                                                                                                                  PID:2760
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall show rule name=all verbose >> config\WindowsFirewallConfig.txt
                                                                                                                                  2⤵
                                                                                                                                    PID:2968
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallConfig.txt
                                                                                                                                    2⤵
                                                                                                                                      PID:1732
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallConfig.txt
                                                                                                                                      2⤵
                                                                                                                                        PID:1980
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /c echo Connection Security Configuration: >> config\WindowsFirewallConfig.txt
                                                                                                                                        2⤵
                                                                                                                                          PID:3056
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallConfig.txt
                                                                                                                                          2⤵
                                                                                                                                            PID:2828
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /c echo Firewall Configuration: >> config\WindowsFirewallConfig.txt
                                                                                                                                            2⤵
                                                                                                                                              PID:2880
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallConfig.txt
                                                                                                                                              2⤵
                                                                                                                                                PID:1352
                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /c echo. >> config\envinfo.txt
                                                                                                                                                2⤵
                                                                                                                                                  PID:1252
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c ipconfig /all >> config\envinfo.txt
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2464
                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c netsh lan show settings >> config\envinfo.txt
                                                                                                                                                    2⤵
                                                                                                                                                      PID:896
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c netsh lan show interfaces >> config\envinfo.txt
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1332
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c ipconfig /all >> config\WcnInfo.txt
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1900
                                                                                                                                                          • C:\Windows\system32\ipconfig.exe
                                                                                                                                                            ipconfig /all
                                                                                                                                                            3⤵
                                                                                                                                                            • Gathers network information
                                                                                                                                                            PID:2912
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c netsh wlan show device >> config\WcnInfo.txt
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1964
                                                                                                                                                            • C:\Windows\system32\netsh.exe
                                                                                                                                                              netsh wlan show device
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1996
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc\Parameters >> config\WcnInfo.txt
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1312
                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                  reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc\Parameters
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1288
                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c netsh advfirewall show currentprofile >> config\WcnInfo.txt
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:796
                                                                                                                                                                    • C:\Windows\system32\netsh.exe
                                                                                                                                                                      netsh advfirewall show currentprofile
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Modifies Windows Firewall
                                                                                                                                                                      PID:2532
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c netsh wfp show filters file=config\wfpfilters.xml > config\wfplog.log
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2352
                                                                                                                                                                      • C:\Windows\system32\netsh.exe
                                                                                                                                                                        netsh wfp show filters file=config\wfpfilters.xml
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:2968
                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c netsh interface teredo show state > config\netiostate.txt
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2120
                                                                                                                                                                          • C:\Windows\system32\netsh.exe
                                                                                                                                                                            netsh interface teredo show state
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:600
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c netsh interface httpstunnel show interface >> config\netiostate.txt
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1088
                                                                                                                                                                              • C:\Windows\system32\netsh.exe
                                                                                                                                                                                netsh interface httpstunnel show interface
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:2408
                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c netsh interface httpstunnel show statistics >> config\netiostate.txt
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1044
                                                                                                                                                                                  • C:\Windows\system32\netsh.exe
                                                                                                                                                                                    netsh interface httpstunnel show statistics
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2744
                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c echo IPCONFIG /DISPLAYDNS: >> config\Dns.txt
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1064
                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c ipconfig /displaydns >> config\Dns.txt
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:940
                                                                                                                                                                                        • C:\Windows\system32\ipconfig.exe
                                                                                                                                                                                          ipconfig /displaydns
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Gathers network information
                                                                                                                                                                                          PID:2292
                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c echo. >> config\Dns.txt
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:1668
                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c echo NETSH NAMESPACE SHOW EFFECTIVE: >> config\Dns.txt
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:924
                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c netsh namespace show effective >> config\Dns.txt
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:988
                                                                                                                                                                                              • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                netsh namespace show effective
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:896
                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c echo. >> config\Dns.txt
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1696
                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c echo NETSH NAMESPACE SHOW POLICY: >> config\Dns.txt
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2488
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c netsh namespace show policy >> config\Dns.txt
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1176
                                                                                                                                                                                                      • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                        netsh namespace show policy
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        PID:1936
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c echo ARP -A: >> config\Neighbors.txt
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:2708
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c arp -a >> config\Neighbors.txt
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2668
                                                                                                                                                                                                        • C:\Windows\system32\ARP.EXE
                                                                                                                                                                                                          arp -a
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:2672
                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c echo. >> config\Neighbors.txt
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          PID:2716
                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c echo NETSH INT IPV6 SHOW NEIGHBORS: >> config\Neighbors.txt
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:1200
                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c netsh int ipv6 show neigh >> config\Neighbors.txt
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:2560
                                                                                                                                                                                                              • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                netsh int ipv6 show neigh
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:2760
                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c echo NBTSTAT -N: >> config\FileSharing.txt
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:2580
                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c nbtstat -n >> config\FileSharing.txt
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:2476
                                                                                                                                                                                                                    • C:\Windows\system32\nbtstat.exe
                                                                                                                                                                                                                      nbtstat -n
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:2564
                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c echo. >> config\FileSharing.txt
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2544
                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c echo NBTSTAT -C: >> config\FileSharing.txt
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:3040
                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c nbtstat -c >> config\FileSharing.txt
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:2864
                                                                                                                                                                                                                            • C:\Windows\system32\nbtstat.exe
                                                                                                                                                                                                                              nbtstat -c
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c echo. >> config\FileSharing.txt
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:2916
                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c echo NET CONFIG RDR: >> config\FileSharing.txt
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:2896
                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c net config rdr >> config\FileSharing.txt
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:3048
                                                                                                                                                                                                                                    • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                      net config rdr
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:1020
                                                                                                                                                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                          C:\Windows\system32\net1 config rdr
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:1808
                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c echo. >> config\FileSharing.txt
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:1388
                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c echo NET CONFIG SRV: >> config\FileSharing.txt
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:1972
                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c net config srv >> config\FileSharing.txt
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1648
                                                                                                                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                net config srv
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:2520
                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\net1 config srv
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:1968
                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c echo. >> config\FileSharing.txt
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:2512
                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c echo NET SHARE: >> config\FileSharing.txt
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1732
                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c net share >> config\FileSharing.txt
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:2532
                                                                                                                                                                                                                                                        • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                          net share
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:2156
                                                                                                                                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\net1 share
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:2320
                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c gpresult /scope:computer /v 1> config\gpresult.txt 2>&1
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:824
                                                                                                                                                                                                                                                              • C:\Windows\system32\gpresult.exe
                                                                                                                                                                                                                                                                gpresult /scope:computer /v
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:2976
                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c netsh wfp show netevents file=config\netevents.xml 1> config\neteventslog.txt 2>&1
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:2412
                                                                                                                                                                                                                                                                  • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                    netsh wfp show netevents file=config\netevents.xml
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:488
                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c netsh wfp show state file=config\wfpstate.xml 1> config\wfpstatelog.txt 2>&1
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1420
                                                                                                                                                                                                                                                                      • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                        netsh wfp show state file=config\wfpstate.xml
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:1540
                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c netsh wfp show sysports file=config\sysports.xml 1> config\sysportslog.txt 2>&1
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:1680
                                                                                                                                                                                                                                                                          • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                            netsh wfp show sysports file=config\sysports.xml
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:1672
                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                          wevtutil epl "Microsoft-Windows-WLAN-AutoConfig/Operational" config\WLANAutoConfigLog.evtx
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                          PID:2388
                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                          wevtutil al config\WLANAutoConfigLog.evtx
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                          PID:1428
                                                                                                                                                                                                                                                                        • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                          netsh wlan show all
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:312
                                                                                                                                                                                                                                                                          • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                            netsh lan show interfaces
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:1656
                                                                                                                                                                                                                                                                            • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                              netsh lan show settings
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:564
                                                                                                                                                                                                                                                                              • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                netsh lan show profiles
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:1016
                                                                                                                                                                                                                                                                                • C:\Windows\system32\ipconfig.exe
                                                                                                                                                                                                                                                                                  ipconfig /all
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                  • Gathers network information
                                                                                                                                                                                                                                                                                  PID:2964
                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                  certutil -v -store -silent -user My
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:2680
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                    netsh advfirewall monitor show firewall
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                    PID:2932
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                    netsh advfirewall monitor show consec
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                    PID:2520
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                    netsh advfirewall firewall show rule name=all verbose
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                    PID:2036
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                    netsh advfirewall monitor show firewall rule name=all
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                    PID:1812
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                                                    netsh advfirewall monitor show consec rule name=all
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                    • Modifies Windows Firewall
                                                                                                                                                                                                                                                                                    PID:832
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                    wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity" config\WindowsFirewallConsecLog.evtx
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                    PID:2644
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                    wevtutil al config\WindowsFirewallConsecLog.evtx
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:1936
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                      wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose" config\WindowsFirewallLogVerbose.evtx
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:2708
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                        wevtutil al config\WindowsFirewallLogVerbose.evtx
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:2688
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                          wevtutil al config\WindowsFirewallConsecLogVerbose.evtx
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                          PID:2600
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                                                                                                                                                          sc query wcncsvc
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                                                                                                                          PID:2920
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "-1104811070-18222302921573332388-1857654419654483136-488261696341329933-1829524728"
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:2696
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "-14647916971533610365-1888879270-16240889661653553455437168006-952579447767501158"
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:2036
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "1915387591-15613442241494017004-1225954497-1893354131-11717383871447228852-444352554"
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:1016
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe "1633396472-2892664520884508932016002431-1531489718-1588076772780773667-1027503580"
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:2464
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "-9665019532361561931953907432-46926642-5104998120458558551608821794455714815"
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                  PID:2688
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "20623048241730269003-1726886044615768906-439109190-79874613-314526873702044485"
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:2732
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "19565366228279858091846952813373633151-866470353590829411755449068-43381457"
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:2636
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "-32351320619981877671390921389-177783153115030854824584374831039008546306354397"
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:664
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "1178099664-147530672-13238007451212721988-22493806216876437461292411080131774999"
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:548
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe "-12210771241994455466-1572351394-732251521819503132-2085656187623218251-928296443"
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:2932
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "-20614529811390086395-2090396168-18468808652122457969-1678623334543099401382702280"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:1964

                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\Dns.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              25B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              dbbe6a0d6c5d16e1f1b3f1a0a02640ab

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ec26045f7867ff5b47edf76ad014fe584243d8ce

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              c6226537e8f06c6916bdf4a19662d28feb21e249c39f41be615b6894c603eb60

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              76dd015a4710c5f2fa9a1ac606e02d40b56595c22e10b8e9f1b9f2f2b57a94f243214ce0026f2d363e4a61ad6fd373e40fdcd7b8f24f747d286124787f3d87ed

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\Dns.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              a7409bce92ebba69939fd68f6d557442

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              a16c23fedb735e7ca9adae9ef79356b4fa771dfc

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              34a54f9c62f27fa39b6e8f2e1671bf59efd6f6e5896d5165532c29f96ee3ab58

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              d8443ade54e8aeb6c7ecd4a99f9c078ae0bf6a5e70882c38e510d8c3085b1792a2788c93294390eefb1321ea7476e6d7377218db2aca1f4b5ce9967c9ed75a01

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\Dns.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              de47cb8e62cc4410bfd0558061a5d05c

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              eb158b15cfccbf3499ffdeaafe22eea818cb558a

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              0de3ffddfb8cda867f11ef70bb61bf60056babf509f022cbcb5640a439a254e7

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              8d5104746e13c9689aa2e755159c57371b975eec572e69d846bfd3234597a557425ca84776bd311ee8943646fd5e2f120b3af7e9e43837c2772f56f3656eb1c3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\Dns.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              de47cb8e62cc4410bfd0558061a5d05c

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              eb158b15cfccbf3499ffdeaafe22eea818cb558a

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              0de3ffddfb8cda867f11ef70bb61bf60056babf509f022cbcb5640a439a254e7

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              8d5104746e13c9689aa2e755159c57371b975eec572e69d846bfd3234597a557425ca84776bd311ee8943646fd5e2f120b3af7e9e43837c2772f56f3656eb1c3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\Dns.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              8e997aac395cf211822ef7959f36d099

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3ee54920a7761a8379b8c646013bb651492e10fb

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              583e0ac9fd3c77c07c8d76bba850e791304d3cd787abecb0786ebe95c91eaa6d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              da29f7b57293278f0155f44dce602fe3e3c2750c965dea79b8b1a447c76e1e4e1636b084668e1c3f4877e9264effc9be512cc8ac30f73484ab52e82436210ec0

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\Dns.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              36c810feab7763074a00770fd9383022

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              62be3bb7d4a50856b6563675b08c366ff87e79be

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              04de07ca6d5acf9441fa063241bfebf9947acce89a66f980cc26781ead5ccc12

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              73ed8f3c0b15b094bceaeb466f5caecfb224bc2806b3cd7eac8baa39b0c45910e141697f238815c8d62787e1a7acd5d079a0cc783245cceb2e264a92358a8a8e

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\Dns.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              36c810feab7763074a00770fd9383022

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              62be3bb7d4a50856b6563675b08c366ff87e79be

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              04de07ca6d5acf9441fa063241bfebf9947acce89a66f980cc26781ead5ccc12

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              73ed8f3c0b15b094bceaeb466f5caecfb224bc2806b3cd7eac8baa39b0c45910e141697f238815c8d62787e1a7acd5d079a0cc783245cceb2e264a92358a8a8e

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\Neighbors.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              10B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              680c0f5b43ef4736633cddb32b417a2d

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ce18efc8ffd6d94f643faef43680d2d105d15cba

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              48d49298867ff9049f8ad01db758a1ef4adc71b5ca2bd5aaa8cdd89806334a23

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              31a6c84e0303364d1a972ea7ce73d22286050b5bcede8c998b10fdebb225505cb740c6d8cc75923977f9f16ab76b8e1aa8967231b50496a7540e64a496c13091

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\Neighbors.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              564B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              c96535be3b609320bf206ae61f5ec862

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d4cb6c911849d0c7426f508917098ad62804f598

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              4287613c5920bf340390c645092404a333d5cad86baf6816ad83130f8bd38c06

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              50a89d5b1a8568c671f3066664de9375768122c3207aabf68e1caef50229eda5e0d1e08ba294cc10ad602e06a99bc03fbd2d61e80a6f1e2a26338a5b2a74b8cc

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\Neighbors.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              597B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              21e29809134a6ff0fa4e33351245e4fd

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              47a9a600f9076f56d5216fde6238d7edbb54f714

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              02eae620050afc6f63cdd86eca153a5f5ca8a6de5b50f0d5de40fa3a5e8e7043

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              399ac3b848b5aea4349e27042597c7bfd7de5dcb66e5cfe0157a5c62d4dbd906331f3be6372bfe87acc437c62fe61c764b3b977335d8d17eb64aa3f285a85125

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\Neighbors.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              597B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              21e29809134a6ff0fa4e33351245e4fd

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              47a9a600f9076f56d5216fde6238d7edbb54f714

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              02eae620050afc6f63cdd86eca153a5f5ca8a6de5b50f0d5de40fa3a5e8e7043

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              399ac3b848b5aea4349e27042597c7bfd7de5dcb66e5cfe0157a5c62d4dbd906331f3be6372bfe87acc437c62fe61c764b3b977335d8d17eb64aa3f285a85125

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              180B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              e9d9c70311e468c5ac1e313ea317e31f

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              3ec7e470b8e8a747dff0b312afbe8f9f859fdb56

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f89da86624bb8f26a5b624932253966dc7cd97ce87eeacf19ed9cc8c77f650be

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              644e4d6b2fe77af31ae29b48a6d46761e3a4cacd1f979bd25994051cc8280b218f7bd6512eb592a11f2b65554551887dde988d264b1e0e215198539d060c1582

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              455B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              11331075e463e6cc232419d9c5a23945

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              2ac8dd5fda25ff577ad32020d417ee7218abb0da

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              5a84886b89430498df9ef0c57b8e982ffbdbd07000678fd94093feec9343fe52

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              eaca25d1656d70b6e7e125476e40ba53cad085da432328b0a8303d4c332b03c37d1fc8b5073f526b8183d18db07f76cc6399ed95255f41f52a9dd89120ee1c74

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              730B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              070b4dc5ec850f127b71640bdedb85fe

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ce294d70ba4a000af61c371a698cc72c9f9d0142

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              c6d65dda676758f2018c2d4a6bf364e41bb28dd46c63a2ff28f81e1ccf494154

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              2f6afe868eca63eecfea7ba24a4a2a02c68ab368d66f803614a03c915b46d5fad747a657566024ae8de2176be7c825b42831a64f0e338dfeb5317edab34582c4

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1005B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              546d39bed845e9fd72c48c29a681c6e1

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d8b1070f02a4160a055e862f9ef5fe1b5c2e69ab

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7b06f66f91635a37fd2c8a6215c120cd536ad1acff45769c244cd8b1e2d27316

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              235a0cee797c5db5bfba51ea71784b34c13970f19a9075fcb14a363e9e698c43f912dee7cf00fbd33d6c6f52679388582a432c3e330e5044a19c21ac4d040ab4

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              239dab30605b95605fd9b6a6ec9740b7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              98ee462fe202a0f9f12aafeb8f044b0d9b5b7ad0

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              0c25e9f59d1b2db5fc59cf926836a90d07b575ab15f63f88171cf783465a7287

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              e7ad7c277d9deb914a2c7dd83f5b0fc5380703bfb28407d9e3be856e17fd501a9c577dbf9ff0a725048fe9a1a96c0a62503888dca32b6bd9892334029190c9e2

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              471755c211cd2a6d9dac12c97cca74b8

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              4ed2b8dbf4789c641abc6cb8694d810973d8f224

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              9ddce13768515a1efd99c23b0b8df4241b6a797a441003a39c94f76d85d2042f

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              131ef906f0e72c6496fa233d07594e95c344119aa5b6dbc33caa2a2714d5ab8ff5d6f6c608ce26abed0f489c3c9d338446112b46ed70cae7ae1aaa2161513ea4

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              34aaec8e266e676ba30d2e8c43134314

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              b54b6d96d79c74f9d184233b310d564f77ff0075

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              6e99ddb93b1ed2e6d8a0a79da6c024771d2a1836c3d3d0f76b2061d7ead0deec

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              641f36a4c9e8736fdb21f1aa7bc234da30b4dfcbde6836b1058c17e21efa812104fab5215907577e1dc0bb6818311e7f43fecef89d4678ad14749479d17baa85

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              11KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3c526e9df0112f41478d9e518c8dc554

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              048b70ee07c5b83205ffb212fae82e8179959ec0

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f1584be06e6379ea9cc0746aa8498856f25ea24065f5b7a59c5116734d6f724e

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              f9cc3d52a971907fa4f93cf14219412e9e886889bd2b4c7737091e8866edab2d79cee06e36aee209090f54fcc540fc522c28ffefc4431356e7f5d05d9688f59c

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              13KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9438cfc4a379b276090ed28296272ced

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              587fc283d55acc67a27b23a3e594b716dfabe36f

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              43ad2708a056c79d9943f7277c237be5a2340745d52d61f854b09e78746af436

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              15f228d7b2c8583d506a5b6a3249917a656164564d660ab07248de226029b189ca2a9e9b58bcec5a90e3e0faf762845f46a90861c12a147eae476fb886dae2ea

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              13KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9438cfc4a379b276090ed28296272ced

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              587fc283d55acc67a27b23a3e594b716dfabe36f

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              43ad2708a056c79d9943f7277c237be5a2340745d52d61f854b09e78746af436

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              15f228d7b2c8583d506a5b6a3249917a656164564d660ab07248de226029b189ca2a9e9b58bcec5a90e3e0faf762845f46a90861c12a147eae476fb886dae2ea

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              13KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3e2c6b37efbfab3d5f36db1e2131cbb0

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              e669ae216a0099f98736c50d0e52648ac4e1d96f

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              c469bbc67497f51cbf4a031ab6f4f57c477166724f4b423cc0067626dc7e486e

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              19651831fc2743fb9772ec0c9b9aa2aff010080a941c112d49eb9983c172ac5d393c8cd933fff7aabcb6afeba1c592dbea101af5b62e7360e9d424647bfed29b

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              13KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              b762c1b379f6a4696997f2a5b5ed9196

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              722227f1b99f1f5fb41fdbfcb75ce24ab250618c

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e90df8fc2b460caf41a3379b744f0d7f72e3ea25aaa484f3991305ca74a55220

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              56478ac401bc00e310d305d08910a478b49b7fc98b539c7548d7b1a5ea8ed7d15bed1869e44ed12d36212afa3a3799ad2ac9c617e9d25e86bac54584542ab620

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              13KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              b762c1b379f6a4696997f2a5b5ed9196

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              722227f1b99f1f5fb41fdbfcb75ce24ab250618c

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e90df8fc2b460caf41a3379b744f0d7f72e3ea25aaa484f3991305ca74a55220

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              56478ac401bc00e310d305d08910a478b49b7fc98b539c7548d7b1a5ea8ed7d15bed1869e44ed12d36212afa3a3799ad2ac9c617e9d25e86bac54584542ab620

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              13KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              a248dabaf15be40c8bbf59fec24d768c

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              41278925bfc5077c1f275d5158b3ad71750e9934

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              eb157fef544012261fece7e6b48f86994fdfb5f84537b560019d8bab4513a105

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              1c7cd9e97d0307f1aa207bd32a98bf76c13c08d8b354787ff33d0388749b87dfece5ea9096e6860cff438bab7272e3a8e0ded2c51bf6a2f133180b3f9e4214db

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              13KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              0a21a76d7e3585fd685040d42fc27932

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              4bcf1f23db6e3364fb5870a3e020ac6c329f2e06

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              d3573254935f804e04a2022ff579c3d6c9dc102fc816129affcdac3a08234a60

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              a2f2889b6e8a628823045295c522617e683bfe5dbd46919da0bc3cdc67cd5c75c3989519d915ad62fe7adc4ffad1c444c4ea072110941bcd1376da9f4f782777

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              13KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              e5fac385e3fd6d7b024ce441c546699a

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              bac945febce0ddfbf7cbc134e749a0ddc3416fb7

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              39a86854ebda40b8de367e30821b6a5a8a6051bbebb39e8044728b1405e69e4d

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              4d33ec4f2066603b5b67feed6931526f760c9d4fc2c006e129d10fdf8336ec2b4499f4c5aaf0f370915417fefd530d6cd4bc09adda44a6e2fd9528ac9e90c11d

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              95B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9b507b45c41b5b76ee28e9a236d2799b

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1faccb7a5024ec67e96277264d8accfad0882863

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              d7d5617f0c7bc136c2c3c813b0aebdf9aa51fc4b660994abd17e843390b64d3c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              28dc0f4f1108150111873f10b43dbbb8c5e99f033f6708a8ce3eed0038ec33fc6a0f48a76d07f468de7ab0e5d67321647c884c7551f7a418e5866151a506eb47

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              95B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              9b507b45c41b5b76ee28e9a236d2799b

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1faccb7a5024ec67e96277264d8accfad0882863

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              d7d5617f0c7bc136c2c3c813b0aebdf9aa51fc4b660994abd17e843390b64d3c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              28dc0f4f1108150111873f10b43dbbb8c5e99f033f6708a8ce3eed0038ec33fc6a0f48a76d07f468de7ab0e5d67321647c884c7551f7a418e5866151a506eb47

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              269B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              0c99db4ea1299da39f74379772611286

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d44af745d19c1903429643342083959e63ad6d76

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              28ba2effafd3cbf220aeaf18f11f372f7b8b6488e7e4467efec9d1e2bba2ce5c

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              b9318720a5d2ab3dd6cc51a8d0f83f2145ed466fc156c191dd62b744b5b4c23ba669b3ccc0167ae47339b9e43f38438dad9b645d98e3f0b1519d56fb51d85a0a

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              344B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              e0fedf98a0859224fea3d5c58c7a9203

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              5792f4561c103e660cc35d0a1d0a05695e5a2879

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              8c62de583360a6e8e86c8de6bc33347f3c998f8849176663b02d8f53eaf8ac43

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              9208984ac1fa1706c5476ba08404718d5360ce222e47e46493312000e250b31e6ac123e673d1bfe893eafbd4221f5637a7530f5287bebf11bdf81ed4ff8af49a

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              344B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              e0fedf98a0859224fea3d5c58c7a9203

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              5792f4561c103e660cc35d0a1d0a05695e5a2879

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              8c62de583360a6e8e86c8de6bc33347f3c998f8849176663b02d8f53eaf8ac43

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              9208984ac1fa1706c5476ba08404718d5360ce222e47e46493312000e250b31e6ac123e673d1bfe893eafbd4221f5637a7530f5287bebf11bdf81ed4ff8af49a

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              623B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              b76fa41618ad1119ea6a03d0c748fe56

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              e6e857be56919ec8c6ef532f6d324e42b3d6791e

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              4b13f4ac8dce26fd89e379c71d2aad179a1701cb4abcb66938047eb3a2dacede

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              6ce38c5c2d1b55a44ea1434ae55cbd7784317dabad87e9c8a28f9f30857d9deede4ef3b4d3d13bbb80f86d7804606fa21d78470b3826e17a63eb575a14152fee

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              698B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              6b06aa1ce0a2c0d2125acfaff7591bd5

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              585853f6b76a8dd1a35aad6b25b6436a0250526b

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              ae90c6a7f11fa209a88bd0e88281acc7e1a6cd4793c678168e72ccf6db724796

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              957a0d38440cd102a91010b3622461811480de991d0a0b5f0c9f7c9aafdfebb954824bae20c1b853dea7a3703809b308ed7b56bc39b4ce59e311b44dc520e6ba

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              698B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              6b06aa1ce0a2c0d2125acfaff7591bd5

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              585853f6b76a8dd1a35aad6b25b6436a0250526b

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              ae90c6a7f11fa209a88bd0e88281acc7e1a6cd4793c678168e72ccf6db724796

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              957a0d38440cd102a91010b3622461811480de991d0a0b5f0c9f7c9aafdfebb954824bae20c1b853dea7a3703809b308ed7b56bc39b4ce59e311b44dc520e6ba

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              958B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              fa70c0c76388ed7ec597187e12feb1f2

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              f7a0b7a3a307d32460e91c9f36c592124bcc0341

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              64ea5af499726361a0a4c7c31e6c2166a960666649448f88a599a8e0cb129e5e

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              e01fdf6af774ffce476b94c2ba7b3cc20b88154f08f809c0662fc77377b789becdf998c6195dbd993dcc63dce0833d9a2e467271c85291fadc23f6cae06cef62

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              7657e67bc70a5a90244ad44dc42107cf

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              77ef972e7ef1ea4283db571a8c12c7818496cfcd

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              28720c68ac798d34c306747c91b6f576743360463096833dd74f1addc9d6d242

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              1bc009142b2dfccd3992ad62c731d8a68f0e6076ea9301935b29b522a37e7f1a56b14720036e87469688f075509d27428ded897f54565d0c59e225d2f71b0f83

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              7657e67bc70a5a90244ad44dc42107cf

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              77ef972e7ef1ea4283db571a8c12c7818496cfcd

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              28720c68ac798d34c306747c91b6f576743360463096833dd74f1addc9d6d242

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              1bc009142b2dfccd3992ad62c731d8a68f0e6076ea9301935b29b522a37e7f1a56b14720036e87469688f075509d27428ded897f54565d0c59e225d2f71b0f83

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3149e60c925b3e4eeb2afa18d221a7ec

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              14b10324f85dcfbccd23cdf49f0f6d2d3b559c9a

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              eb6811e21dc49b4a2218a9f3d44c83eec0e89488fb4340b75308d63f3a3f97cc

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              673ce17238e9981a091d7f8c8761f905d722ff9994edbc7d6dadeb6442baea55138a8c0a29bf61b9e71f250ecd2273e57adb02c68f5db5e5d92e093b83c066aa

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3c3bfb6800aeab3caaf49a7632fff3bb

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              805676e841b7ded8fe76b91bcdd5cb12204deb60

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              2a36a69a436e4f3ac6b4739c47c572b551efbc74d0bd5146fb4f1ae74735c8cb

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              2b997d344683d8a891df05b119921ea43a27285795d1eef52c61b4639e200c7b6a15b029f75e9fa97d2c3bd7204095da930c0b2547def84249774ee6a24b24ce

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3c3bfb6800aeab3caaf49a7632fff3bb

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              805676e841b7ded8fe76b91bcdd5cb12204deb60

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              2a36a69a436e4f3ac6b4739c47c572b551efbc74d0bd5146fb4f1ae74735c8cb

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              2b997d344683d8a891df05b119921ea43a27285795d1eef52c61b4639e200c7b6a15b029f75e9fa97d2c3bd7204095da930c0b2547def84249774ee6a24b24ce

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallEffectiveRules.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              113B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              f922ce103305d2d2766cd69b4992bed4

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              e43c5ec1882020e9f59bf8be1f7b039b7279aec9

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              673712f1a5ddf23348ad5dd910c0fad7656d5c4b60f9d9d6b413aa7ed20f3612

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              65b2dd117d6ac6d8589ebaf1c22d3dff59cc79887eb53e8951f53160b9cc6ecabecd2a32d0e54d4cf517258118ed48791d0e9f679b3e166974aaa18faff8112f

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallEffectiveRules.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              113B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              f922ce103305d2d2766cd69b4992bed4

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              e43c5ec1882020e9f59bf8be1f7b039b7279aec9

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              673712f1a5ddf23348ad5dd910c0fad7656d5c4b60f9d9d6b413aa7ed20f3612

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              65b2dd117d6ac6d8589ebaf1c22d3dff59cc79887eb53e8951f53160b9cc6ecabecd2a32d0e54d4cf517258118ed48791d0e9f679b3e166974aaa18faff8112f

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallEffectiveRules.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              407B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              445273f6cb444643254868591238cb3f

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              df0fccd4475453a9ce599105bc32d41dcc26c2c4

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              322b29c363f0c96f7c0537f31aee08606d90c1f750af05a65beaca6a8d1e5d98

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              82ac8c4c0da86646145fef16c65a51f2ab499fea90bd87cf6c553591402340983ecc051fa04c8585a0220c6c21f2e9a4f3a5b30d1083dba606c8c6d996656b7b

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallEffectiveRules.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              482B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              8eaea0bd242613fabfdd0db2d5c35a69

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              b534ded196120d8b34f8d72503ca548a88574734

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              6339ea308fae5552302e96d5328b72f070452911d757b87e27b46db665595431

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              2cc1a9349c507aaee258d0b545516f1f7b662d36111d15add4ae00ac6b55809128b46472e5254ed62688b93e8122a9aa686ab8467f04cc08a8b2629b98eed52f

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallEffectiveRules.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              482B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              8eaea0bd242613fabfdd0db2d5c35a69

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              b534ded196120d8b34f8d72503ca548a88574734

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              6339ea308fae5552302e96d5328b72f070452911d757b87e27b46db665595431

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              2cc1a9349c507aaee258d0b545516f1f7b662d36111d15add4ae00ac6b55809128b46472e5254ed62688b93e8122a9aa686ab8467f04cc08a8b2629b98eed52f

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              efa45f7417c6fdd820f92eb9fe2ad385

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              df06bb2c72cdfecb30ba4f2d7987af2132619956

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f4e2d341997019e19a12aae7bbe09a156e878735faaa3b84c54325f19cb81241

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              64d5813ab2743a6f81bbc67fe7bc1934cabd1d54cceb0ad9fe6b81d108dd3bdfe31aa93f9cbe9caf5fb972443167bfaf22201abde71facc43f042d84d867275b

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              c052db9713e718767e6c9db8f52ffe06

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              38bacb9e9e69f6d0fd2d86bb2d8e8f74c2b81e28

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              6d27b33e5f2f8dff0ff618db23377ef91a5abf688318fb1b2d4901c01ad93fbb

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              e61589159f42f8e20c046d2af01af95b2975636bffede352972cc69c50fadd4d00e6f428514d120487b82d80373bf1c3b4ace68bd5c20277ed78d0039b79a192

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              c036c551230385531d8cb29b9fa2b2e9

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1f83e29b4ad5f3b8a82672f2679af8f090d773c3

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              0bff62c11bf9ccb1ee30a3f942dcc16612128d3ed8584d2f4d36bd695884cbeb

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              f7be0687ab69bbc5f209a313b2634444336b2edfe72ad6a456bc93699623232363cd5a87ce1496c110e0e8838a684bc02985df3d8f99e4f40c1e02e6522151f9

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3e8e5b08f236e5b712ec9ddffc108e99

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              5427399bd87a32640f41e321e8b2e7c5e8f21039

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              1da4824ceda35c99c35c2af1399133aa5919baf3bee09e6c2be0d63e06238e8b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              063d34fd50d25892d76294bf405b44f58b6e1f53e3fba8d81e1ea18b278401ff8b5ef819f6de53b24bf9a3835a5f891bb46e07d5747dfe586c70c89469d403ff

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ad5fcaf463d0e954540906e4970613f7

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              1fd1578991790e9cc23e4b898dbddea1cfe74f04

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              f6f3d21ca69f58cf65cf6f6cef8d151b225a7c171ac1a043e5962d099c25be57

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              12a3b0643c193f6718b2006eed19ad2aefbcdcee49b234b141e9710a80121f20c66c8c46541aa7784c1e18a595ec07897af217221bb29540e93e8a1025a2663e

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              029a13745e068d043ad9a337acc864e0

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              107f30d27ffeddabb007c7ddd272c7772a41ac7a

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              81ff9d87abd03cfd0039b1a982df30c8c2f248c5019434c2e346b8d08c23aadf

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              c6ce5c3e62a2c04058ea6c475025faac9d5e5e100b8b86787417d0664a34448309c298c7ebd2dfdb798c9d132763a54ff6c79247111a4ae0358b7fcb55d9e6a3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              029a13745e068d043ad9a337acc864e0

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              107f30d27ffeddabb007c7ddd272c7772a41ac7a

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              81ff9d87abd03cfd0039b1a982df30c8c2f248c5019434c2e346b8d08c23aadf

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              c6ce5c3e62a2c04058ea6c475025faac9d5e5e100b8b86787417d0664a34448309c298c7ebd2dfdb798c9d132763a54ff6c79247111a4ae0358b7fcb55d9e6a3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ea2d7b6cc71f046cf0eb580923129857

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              bb96ab556f1b63d7ca88dd72a541a5db7759611a

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              cea43fe19fe855ac70d8f77d4c5515155777cdcf05847b888ef2123288d897c0

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7004818b59da86dc7b1582d514d377e74a969f7e9b869c4fa53f754d14be58876bb6bd7af6df665215087789748b05865e58444d27869dd51179725e6eb4fea3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ea2d7b6cc71f046cf0eb580923129857

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              bb96ab556f1b63d7ca88dd72a541a5db7759611a

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              cea43fe19fe855ac70d8f77d4c5515155777cdcf05847b888ef2123288d897c0

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7004818b59da86dc7b1582d514d377e74a969f7e9b869c4fa53f754d14be58876bb6bd7af6df665215087789748b05865e58444d27869dd51179725e6eb4fea3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ea2d7b6cc71f046cf0eb580923129857

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              bb96ab556f1b63d7ca88dd72a541a5db7759611a

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              cea43fe19fe855ac70d8f77d4c5515155777cdcf05847b888ef2123288d897c0

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              7004818b59da86dc7b1582d514d377e74a969f7e9b869c4fa53f754d14be58876bb6bd7af6df665215087789748b05865e58444d27869dd51179725e6eb4fea3

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              7675270e9c00c2845859b00e626eb4c3

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              c2bc2397905d45f50551fd25a515a7bea5d255ea

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              b7731b1600756f6c3da0ebf2258dc80ae4112ab3892ed666cc7d6801e46cfa3e

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              c5ce0395a40f1824054391edc6d2951af243f74fa8f55e70f0ebf78f841c72c1f90229027669e57abf09d8d79df4a65e8b3463e585c3a605234c058a968c673b

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              6KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              7675270e9c00c2845859b00e626eb4c3

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              c2bc2397905d45f50551fd25a515a7bea5d255ea

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              b7731b1600756f6c3da0ebf2258dc80ae4112ab3892ed666cc7d6801e46cfa3e

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              c5ce0395a40f1824054391edc6d2951af243f74fa8f55e70f0ebf78f841c72c1f90229027669e57abf09d8d79df4a65e8b3463e585c3a605234c058a968c673b

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\netiostate.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              235B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              ce9b212f0664a02869ad22567948e855

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              eb2f569033e7ce112e07a67dae005c1540f240b2

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              7615be2f16750a3b49600fc4490a7d3d5234a9d101dd05e2e4a07f454a16f1e8

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              3fa857f337127d1742ea0a7ed9cdc0766f5487da4d1779364b548e84a8813868d5c35c20870e6e91c98aefb3107336239d8d7e283b89b0e56b1c4bf2bdbe93a5

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\netiostate.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              237B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              d31176316a105bc00a95dc6214d78eb6

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              ecfaab90e8db60610647323cd28a018d882d36bd

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e24f96354416537eb72d123e12f9cafdf7f2fd624ed52fd51112800913613199

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              72b355af3bfffb84e17e00a0123b96f395d223ade286bbc03b1f4dc817ecfad5908e840d13367b281fb2198ca0bbfdb42dbdbfd37a2934d1963d214a3c519b3d

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\osinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              187B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              a296a4233e07760e59d0f979d6bce642

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              255a632d598e3654c87f0cce3d6b53c464b6770f

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              b6acdc07538b4893dc6203e18805996d08d12de895062f34d95497faa6d25e0b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              b6a6efb5e082fdd97a1ad36483c0a5bbc7f183a1a06a2ff0f504862fb4f2e1bacf3d03b946a4408d34c761a450eceb85c25153c9819bb7436793ec459509a769

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\osinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              223B

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              3839b4ef0a60449d0b916cb858f8e6ab

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              47fd428a8a9ec91316c0248dcf9fb117f628f860

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              d37f6aeea9f98bfcf587cf593085d0614624b61df220adc3657a89457169e259

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              bda997f0cf01155b30332bb5b70873b6c863b10ffce87972b97a64fd8f38802be135520a23cab4226744abb51818d437b557fb87f2bfb936746df1145322c8e5

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\osinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              91a3e1c668da59acd955698518bf899d

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              f5dc8a9defbcc4035c4d18d28132a40ed69e1444

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              e094985b46f505ee89a7c28ed67cfe9afa66e2847c42f177ac2341cf5eeef6e5

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              8586f20a1ecce1088b7f985c0a27c924d68c8440b5038dd18655c815f23abe173a9a814a04bb9f47d862838a7db4122cd25b11bd41c1974f61457cbf604455bf

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\osinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              0c7269a432995e986957372bf6699e4e

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              abccd887a85a2e3fa715f1dac71e10dc250eeb07

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              32ba8eedfff954ed723dab6420965e7079e181f61b30d02ed365b1e405eaa1aa

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              a416f81195150527364a20e763c86d4082f9360165c7c870c243e3e200b277ac6944ce74c2a151348033b904cc216cc3787bb75649d93a92b40a1da6913c6998

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\config\osinfo.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              3KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              54451dbaeaafffb660e1bc378b0415cb

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              de5826e8cc957609f282b657846f3b1e7352154d

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              76184d4249d10cec2f799f216e377adbee9143a7219a7dc059aaad7d5395e34b

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              532ed5964f52d4b88d9ba6d4dc2c7587c72806bb6fd045b5767ea002a4592ade1cf5ba719102fac7e41f10cfe5841ae6592b750a4f0734e19ca10d5e005e85c5

                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\tempfile.txt

                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                              93304a25905b0fad5e0ded826dc8b164

                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                              d5e752594b93257c43504cc09b8b8c36aec8841e

                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                              6d9addd49371072c03584fa5f5a6e403b3b1a8c3d4a1c416f71c7b52ccc8f189

                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                              13fb1793ef4ad94535cb79d301c1e4cee358c2d3871974fbdb19f9e115e5a0163b980aca3f76c73ac12eb4176630e58eb9d6fd0e3a6def1a306de581bb49edbd