a873a7d3b90c6f2d156e5026b72a5652d4893081cd188300141a95dc38cba56b

Analysis

max time kernel
117s
max time network
138s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gatherNetworkInfo.vbs
Size

39KB
MD5

2ae808cb0d9a667b0cf41ea74b3b9bac
SHA1

628b6b4bf3cc7f77578cf3ccfcc587dbf9ec7e07
SHA256

a873a7d3b90c6f2d156e5026b72a5652d4893081cd188300141a95dc38cba56b
SHA512

667e1d082658b36cf7d8cae68d6055a51599d7d411fd5615f1431e15a0d30f267f6447b575bebc034ac7e9b77a1b478c3718801f9848945140be4ee979bc8bff
SSDEEP

768:8IYHILRGUJX4mlrU5R/A+Tr/GsfpkgKo9kNxyJ4OORfWXyB22rQeWE5TloYL7TBY:8IYHILRGUJImlrc/A+3fpkgKo9kNxyJt

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 8 IoCs

evasion

Windows Service

T1543.003

pid	Process
2236	netsh.exe
1812	netsh.exe
832	netsh.exe
2532	netsh.exe
1816	netsh.exe
2932	netsh.exe
2520	netsh.exe
2036	netsh.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2920	sc.exe
2864	sc.exe
664	sc.exe
1324	sc.exe
2636	sc.exe
2640	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2252	tasklist.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2964	ipconfig.exe
2912	ipconfig.exe
2292	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2248	systeminfo.exe

Runs net.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2092	WScript.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2252	tasklist.exe
Token: SeSecurityPrivilege	2388	wevtutil.exe
Token: SeBackupPrivilege	2388	wevtutil.exe
Token: SeSecurityPrivilege	1428	wevtutil.exe
Token: SeBackupPrivilege	1428	wevtutil.exe
Token: SeSecurityPrivilege	2200	wevtutil.exe
Token: SeBackupPrivilege	2200	wevtutil.exe
Token: SeSecurityPrivilege	368	wevtutil.exe
Token: SeBackupPrivilege	368	wevtutil.exe
Token: SeSecurityPrivilege	2644	wevtutil.exe
Token: SeBackupPrivilege	2644	wevtutil.exe
Token: SeSecurityPrivilege	1936	netsh.exe
Token: SeBackupPrivilege	1936	netsh.exe
Token: SeSecurityPrivilege	2708	cmd.exe
Token: SeBackupPrivilege	2708	cmd.exe
Token: SeSecurityPrivilege	2688	conhost.exe
Token: SeBackupPrivilege	2688	conhost.exe
Token: SeSecurityPrivilege	2716	cmd.exe
Token: SeBackupPrivilege	2716	cmd.exe
Token: SeSecurityPrivilege	2600	wevtutil.exe
Token: SeBackupPrivilege	2600	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1340	2092	WScript.exe	28
PID 2092 wrote to memory of 1340	2092	WScript.exe	28
PID 2092 wrote to memory of 1340	2092	WScript.exe	28
PID 1340 wrote to memory of 2692	1340	cmd.exe	30
PID 1340 wrote to memory of 2692	1340	cmd.exe	30
PID 1340 wrote to memory of 2692	1340	cmd.exe	30
PID 2092 wrote to memory of 2816	2092	WScript.exe	31
PID 2092 wrote to memory of 2816	2092	WScript.exe	31
PID 2092 wrote to memory of 2816	2092	WScript.exe	31
PID 2816 wrote to memory of 2668	2816	cmd.exe	33
PID 2816 wrote to memory of 2668	2816	cmd.exe	33
PID 2816 wrote to memory of 2668	2816	cmd.exe	33
PID 2092 wrote to memory of 2696	2092	WScript.exe	34
PID 2092 wrote to memory of 2696	2092	WScript.exe	34
PID 2092 wrote to memory of 2696	2092	WScript.exe	34
PID 2696 wrote to memory of 2840	2696	cmd.exe	36
PID 2696 wrote to memory of 2840	2696	cmd.exe	36
PID 2696 wrote to memory of 2840	2696	cmd.exe	36
PID 2092 wrote to memory of 2920	2092	WScript.exe	37
PID 2092 wrote to memory of 2920	2092	WScript.exe	37
PID 2092 wrote to memory of 2920	2092	WScript.exe	37
PID 2920 wrote to memory of 2732	2920	cmd.exe	39
PID 2920 wrote to memory of 2732	2920	cmd.exe	39
PID 2920 wrote to memory of 2732	2920	cmd.exe	39
PID 2092 wrote to memory of 2620	2092	WScript.exe	40
PID 2092 wrote to memory of 2620	2092	WScript.exe	40
PID 2092 wrote to memory of 2620	2092	WScript.exe	40
PID 2620 wrote to memory of 2584	2620	cmd.exe	42
PID 2620 wrote to memory of 2584	2620	cmd.exe	42
PID 2620 wrote to memory of 2584	2620	cmd.exe	42
PID 2092 wrote to memory of 2608	2092	WScript.exe	43
PID 2092 wrote to memory of 2608	2092	WScript.exe	43
PID 2092 wrote to memory of 2608	2092	WScript.exe	43
PID 2608 wrote to memory of 1352	2608	cmd.exe	45
PID 2608 wrote to memory of 1352	2608	cmd.exe	45
PID 2608 wrote to memory of 1352	2608	cmd.exe	45
PID 2092 wrote to memory of 3060	2092	WScript.exe	46
PID 2092 wrote to memory of 3060	2092	WScript.exe	46
PID 2092 wrote to memory of 3060	2092	WScript.exe	46
PID 3060 wrote to memory of 2492	3060	cmd.exe	48
PID 3060 wrote to memory of 2492	3060	cmd.exe	48
PID 3060 wrote to memory of 2492	3060	cmd.exe	48
PID 2092 wrote to memory of 3044	2092	WScript.exe	49
PID 2092 wrote to memory of 3044	2092	WScript.exe	49
PID 2092 wrote to memory of 3044	2092	WScript.exe	49
PID 3044 wrote to memory of 1988	3044	cmd.exe	51
PID 3044 wrote to memory of 1988	3044	cmd.exe	51
PID 3044 wrote to memory of 1988	3044	cmd.exe	51
PID 2092 wrote to memory of 2756	2092	WScript.exe	52
PID 2092 wrote to memory of 2756	2092	WScript.exe	52
PID 2092 wrote to memory of 2756	2092	WScript.exe	52
PID 2756 wrote to memory of 2864	2756	cmd.exe	54
PID 2756 wrote to memory of 2864	2756	cmd.exe	54
PID 2756 wrote to memory of 2864	2756	cmd.exe	54
PID 2092 wrote to memory of 2664	2092	WScript.exe	56
PID 2092 wrote to memory of 2664	2092	WScript.exe	56
PID 2092 wrote to memory of 2664	2092	WScript.exe	56
PID 2664 wrote to memory of 528	2664	cmd.exe	57
PID 2664 wrote to memory of 528	2664	cmd.exe	57
PID 2664 wrote to memory of 528	2664	cmd.exe	57
PID 2092 wrote to memory of 2912	2092	WScript.exe	58
PID 2092 wrote to memory of 2912	2092	WScript.exe	58
PID 2092 wrote to memory of 2912	2092	WScript.exe	58
PID 2912 wrote to memory of 2924	2912	cmd.exe	60

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\gatherNetworkInfo.vbs"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\Notifications" Reg\Notif.reg.txt /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\system32\reg.exe
    reg export "HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\Notifications" Reg\Notif.reg.txt /y
    3⤵
    PID:2692
- - C:\Windows\system32\certutil.exe
    certutil -v -store -silent My
    3⤵
    PID:2844
  - - C:\Windows\system32\wevtutil.exe
      wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose" config\WindowsFirewallConsecLogVerbose.evtx
      4⤵
      PID:2716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers" Reg\AllCred.reg.txt /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\system32\reg.exe
    reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers" Reg\AllCred.reg.txt /y
    3⤵
    PID:2668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters" Reg\AllCredFilter.reg.txt /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\system32\reg.exe
    reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters" Reg\AllCredFilter.reg.txt /y
    3⤵
    PID:2840
- - C:\Windows\system32\netsh.exe
    netsh winsock show catalog
    3⤵
    PID:2700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{07AA0886-CC8D-4e19-A410-1C75AF686E62}" Reg\{07AA0886-CC8D-4e19-A410-1C75AF686E62}.reg.txt /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\system32\reg.exe
    reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{07AA0886-CC8D-4e19-A410-1C75AF686E62}" Reg\{07AA0886-CC8D-4e19-A410-1C75AF686E62}.reg.txt /y
    3⤵
    PID:2732
  - - C:\Windows\system32\sc.exe
      sc query wlansvc
      4⤵
      Launches sc.exe
      PID:2640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{33c86cd6-705f-4ba1-9adb-67070b837775}" Reg\{33c86cd6-705f-4ba1-9adb-67070b837775}.reg.txt /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\system32\reg.exe
    reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{33c86cd6-705f-4ba1-9adb-67070b837775}" Reg\{33c86cd6-705f-4ba1-9adb-67070b837775}.reg.txt /y
    3⤵
    PID:2584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{edd749de-2ef1-4a80-98d1-81f20e6df58e}" Reg\{edd749de-2ef1-4a80-98d1-81f20e6df58e}.reg.txt /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\reg.exe
    reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{edd749de-2ef1-4a80-98d1-81f20e6df58e}" Reg\{edd749de-2ef1-4a80-98d1-81f20e6df58e}.reg.txt /y
    3⤵
    PID:1352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters\WlanAPIPermissions" Reg\APIPerm.reg.txt /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\system32\reg.exe
    reg export "HKLM\SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters\WlanAPIPermissions" Reg\APIPerm.reg.txt /y
    3⤵
    PID:2492
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall monitor show currentprofile
      4⤵
      Modifies Windows Firewall
      PID:1816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\Wireless\GPTWirelessPolicy" Reg\GPT.reg.txt /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\system32\reg.exe
    reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\Wireless\GPTWirelessPolicy" Reg\GPT.reg.txt /y
    3⤵
    PID:1988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg export "HKCU\SOFTWARE\Microsoft\Wlansvc" Reg\HKCUWlanSvc.reg.txt /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\system32\reg.exe
    reg export "HKCU\SOFTWARE\Microsoft\Wlansvc" Reg\HKCUWlanSvc.reg.txt /y
    3⤵
    PID:2864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Microsoft\Wlansvc" Reg\HKLMWlanSvc.reg.txt /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\system32\reg.exe
    reg export "HKLM\SOFTWARE\Microsoft\Wlansvc" Reg\HKLMWlanSvc.reg.txt /y
    3⤵
    PID:528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Microsoft\dot3svc" Reg\HKLMDot3Svc.reg.txt /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\system32\reg.exe
    reg export "HKLM\SOFTWARE\Microsoft\dot3svc" Reg\HKLMDot3Svc.reg.txt /y
    3⤵
    PID:2924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg export "HKCU\SOFTWARE\Microsoft\dot3svc" Reg\HKCUDot3Svc.reg.txt /y
  2⤵
  PID:3024
- - C:\Windows\system32\reg.exe
    reg export "HKCU\SOFTWARE\Microsoft\dot3svc" Reg\HKCUDot3Svc.reg.txt /y
    3⤵
    PID:1900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\WiredL2\GP_Policy" Reg\L2GP.reg.txt /y
  2⤵
  PID:1616
- - C:\Windows\system32\reg.exe
    reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\WiredL2\GP_Policy" Reg\L2GP.reg.txt /y
    3⤵
    PID:1904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg export "HKLM\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\NetworkList" Reg\NetworkProfiles.reg.txt /y
  2⤵
  PID:2028
- - C:\Windows\system32\reg.exe
    reg export "HKLM\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\NetworkList" Reg\NetworkProfiles.reg.txt /y
    3⤵
    PID:1964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c set processor >> config\osinfo.txt
  2⤵
  PID:1952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c systeminfo >> config\osinfo.txt
  2⤵
  PID:2300
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:2248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c set u >> config\osinfo.txt
  2⤵
  PID:1928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tasklist > tempfile.txt
  2⤵
  PID:552
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil epl "Microsoft-Windows-WLAN-AutoConfig/Operational" config\WLANAutoConfigLog.evtx
  2⤵
  PID:1088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil al config\WLANAutoConfigLog.evtx
  2⤵
  PID:1044
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh wlan show all > config\envinfo.txt
  2⤵
  PID:1540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh lan show profiles >> config\envinfo.txt
  2⤵
  PID:1696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo ROUTE PRINT: >> config\envinfo.txt
  2⤵
  PID:1936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c route print >> config\envinfo.txt
  2⤵
  PID:1592
- - C:\Windows\system32\ROUTE.EXE
    route print
    3⤵
    PID:2780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c certutil -v -store -silent My >> config\envinfo.txt
  2⤵
  PID:1340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh winsock show catalog > config\WinsockCatalog.txt
  2⤵
  PID:2696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c certutil -v -store -silent -user My >> config\envinfo.txt
  2⤵
  PID:2812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Current Profiles: > config\WindowsFirewallConfig.txt
  2⤵
  PID:2564
- - C:\Windows\system32\sc.exe
    sc query eaphost
    3⤵
    - Launches sc.exe
    PID:2636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall monitor show currentprofile >> config\WindowsFirewallConfig.txt
  2⤵
  PID:2492
- - C:\Windows\system32\sc.exe
    sc query upnphost
    3⤵
    - Launches sc.exe
    PID:2864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall monitor show firewall >> config\WindowsFirewallConfig.txt
  2⤵
  PID:548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall monitor show consec >> config\WindowsFirewallConfig.txt
  2⤵
  PID:1348
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Firewall Rules : >> config\WindowsFirewallConfig.txt
  2⤵
  PID:2356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallConfig.txt
  2⤵
  PID:600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall consec show rule name=all verbose >> config\WindowsFirewallConfig.txt
  2⤵
  PID:1864
- - C:\Windows\system32\netsh.exe
    netsh advfirewall consec show rule name=all verbose
    3⤵
    - Modifies Windows Firewall
    PID:2236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall monitor show firewall rule name=all >> config\WindowsFirewallEffectiveRules.txt
  2⤵
  PID:940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallEffectiveRules.txt
  2⤵
  PID:2272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall monitor show consec rule name=all >> config\WindowsFirewallEffectiveRules.txt
  2⤵
  PID:2440
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" config\WindowsFirewallLog.evtx
  2⤵
  PID:2224
- - C:\Windows\system32\wevtutil.exe
    wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" config\WindowsFirewallLog.evtx
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil al config\WindowsFirewallLog.evtx
  2⤵
  PID:2280
- - C:\Windows\system32\wevtutil.exe
    wevtutil al config\WindowsFirewallLog.evtx
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Connection Security Rules currently enforced : >> config\WindowsFirewallEffectiveRules.txt
  2⤵
  PID:1084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallEffectiveRules.txt
  2⤵
  PID:2744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Firewall Rules currently enforced : > config\WindowsFirewallEffectiveRules.txt
  2⤵
  PID:1420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity" config\WindowsFirewallConsecLog.evtx
  2⤵
  PID:1176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil al config\WindowsFirewallConsecLog.evtx
  2⤵
  PID:1956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Connection Security Rules : >> config\WindowsFirewallConfig.txt
  2⤵
  PID:1928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose" config\WindowsFirewallLogVerbose.evtx
  2⤵
  PID:2776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil al config\WindowsFirewallLogVerbose.evtx
  2⤵
  PID:2764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose" config\WindowsFirewallConsecLogVerbose.evtx
  2⤵
  PID:2844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wevtutil al config\WindowsFirewallConsecLogVerbose.evtx
  2⤵
  PID:2768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc query fdrespub >> config\WcnInfo.txt
  2⤵
  PID:3040
- - C:\Windows\system32\sc.exe
    sc query fdrespub
    3⤵
    - Launches sc.exe
    PID:1324
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc query eaphost >> config\WcnInfo.txt
  2⤵
  PID:2872
- - C:\Windows\system32\sc.exe
    sc query eaphost
    3⤵
    - Launches sc.exe
    PID:664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc query upnphost >> config\WcnInfo.txt
  2⤵
  PID:2492
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc query eaphost >> config\WcnInfo.txt
  2⤵
  PID:2564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc query wlansvc >> config\WcnInfo.txt
  2⤵
  PID:2732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc query wcncsvc >> config\WcnInfo.txt
  2⤵
  PID:2760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall show rule name=all verbose >> config\WindowsFirewallConfig.txt
  2⤵
  PID:2968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallConfig.txt
  2⤵
  PID:1732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallConfig.txt
  2⤵
  PID:1980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Connection Security Configuration: >> config\WindowsFirewallConfig.txt
  2⤵
  PID:3056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallConfig.txt
  2⤵
  PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Firewall Configuration: >> config\WindowsFirewallConfig.txt
  2⤵
  PID:2880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallConfig.txt
  2⤵
  PID:1352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo. >> config\envinfo.txt
  2⤵
  PID:1252
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /all >> config\envinfo.txt
  2⤵
  PID:2464
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh lan show settings >> config\envinfo.txt
  2⤵
  PID:896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh lan show interfaces >> config\envinfo.txt
  2⤵
  PID:1332
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /all >> config\WcnInfo.txt
  2⤵
  PID:1900
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh wlan show device >> config\WcnInfo.txt
  2⤵
  PID:1964
- - C:\Windows\system32\netsh.exe
    netsh wlan show device
    3⤵
    PID:1996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc\Parameters >> config\WcnInfo.txt
  2⤵
  PID:1312
- - C:\Windows\system32\reg.exe
    reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc\Parameters
    3⤵
    PID:1288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall show currentprofile >> config\WcnInfo.txt
  2⤵
  PID:796
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show currentprofile
    3⤵
    - Modifies Windows Firewall
    PID:2532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh wfp show filters file=config\wfpfilters.xml > config\wfplog.log
  2⤵
  PID:2352
- - C:\Windows\system32\netsh.exe
    netsh wfp show filters file=config\wfpfilters.xml
    3⤵
    PID:2968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh interface teredo show state > config\netiostate.txt
  2⤵
  PID:2120
- - C:\Windows\system32\netsh.exe
    netsh interface teredo show state
    3⤵
    PID:600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh interface httpstunnel show interface >> config\netiostate.txt
  2⤵
  PID:1088
- - C:\Windows\system32\netsh.exe
    netsh interface httpstunnel show interface
    3⤵
    PID:2408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh interface httpstunnel show statistics >> config\netiostate.txt
  2⤵
  PID:1044
- - C:\Windows\system32\netsh.exe
    netsh interface httpstunnel show statistics
    3⤵
    PID:2744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo IPCONFIG /DISPLAYDNS: >> config\Dns.txt
  2⤵
  PID:1064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ipconfig /displaydns >> config\Dns.txt
  2⤵
  PID:940
- - C:\Windows\system32\ipconfig.exe
    ipconfig /displaydns
    3⤵
    - Gathers network information
    PID:2292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo. >> config\Dns.txt
  2⤵
  PID:1668
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo NETSH NAMESPACE SHOW EFFECTIVE: >> config\Dns.txt
  2⤵
  PID:924
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh namespace show effective >> config\Dns.txt
  2⤵
  PID:988
- - C:\Windows\system32\netsh.exe
    netsh namespace show effective
    3⤵
    PID:896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo. >> config\Dns.txt
  2⤵
  PID:1696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo NETSH NAMESPACE SHOW POLICY: >> config\Dns.txt
  2⤵
  PID:2488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh namespace show policy >> config\Dns.txt
  2⤵
  PID:1176
- - C:\Windows\system32\netsh.exe
    netsh namespace show policy
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo ARP -A: >> config\Neighbors.txt
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c arp -a >> config\Neighbors.txt
  2⤵
  PID:2668
- - C:\Windows\system32\ARP.EXE
    arp -a
    3⤵
    PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo. >> config\Neighbors.txt
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo NETSH INT IPV6 SHOW NEIGHBORS: >> config\Neighbors.txt
  2⤵
  PID:1200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh int ipv6 show neigh >> config\Neighbors.txt
  2⤵
  PID:2560
- - C:\Windows\system32\netsh.exe
    netsh int ipv6 show neigh
    3⤵
    PID:2760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo NBTSTAT -N: >> config\FileSharing.txt
  2⤵
  PID:2580
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c nbtstat -n >> config\FileSharing.txt
  2⤵
  PID:2476
- - C:\Windows\system32\nbtstat.exe
    nbtstat -n
    3⤵
    PID:2564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo. >> config\FileSharing.txt
  2⤵
  PID:2544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo NBTSTAT -C: >> config\FileSharing.txt
  2⤵
  PID:3040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c nbtstat -c >> config\FileSharing.txt
  2⤵
  PID:2864
- - C:\Windows\system32\nbtstat.exe
    nbtstat -c
    3⤵
    PID:3032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo. >> config\FileSharing.txt
  2⤵
  PID:2916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo NET CONFIG RDR: >> config\FileSharing.txt
  2⤵
  PID:2896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net config rdr >> config\FileSharing.txt
  2⤵
  PID:3048
- - C:\Windows\system32\net.exe
    net config rdr
    3⤵
    PID:1020
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 config rdr
      4⤵
      PID:1808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo. >> config\FileSharing.txt
  2⤵
  PID:1388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo NET CONFIG SRV: >> config\FileSharing.txt
  2⤵
  PID:1972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net config srv >> config\FileSharing.txt
  2⤵
  PID:1648
- - C:\Windows\system32\net.exe
    net config srv
    3⤵
    PID:2520
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 config srv
      4⤵
      PID:1968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo. >> config\FileSharing.txt
  2⤵
  PID:2512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo NET SHARE: >> config\FileSharing.txt
  2⤵
  PID:1732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c net share >> config\FileSharing.txt
  2⤵
  PID:2532
- - C:\Windows\system32\net.exe
    net share
    3⤵
    PID:2156
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 share
      4⤵
      PID:2320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gpresult /scope:computer /v 1> config\gpresult.txt 2>&1
  2⤵
  PID:824
- - C:\Windows\system32\gpresult.exe
    gpresult /scope:computer /v
    3⤵
    PID:2976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh wfp show netevents file=config\netevents.xml 1> config\neteventslog.txt 2>&1
  2⤵
  PID:2412
- - C:\Windows\system32\netsh.exe
    netsh wfp show netevents file=config\netevents.xml
    3⤵
    PID:488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh wfp show state file=config\wfpstate.xml 1> config\wfpstatelog.txt 2>&1
  2⤵
  PID:1420
- - C:\Windows\system32\netsh.exe
    netsh wfp show state file=config\wfpstate.xml
    3⤵
    PID:1540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh wfp show sysports file=config\sysports.xml 1> config\sysportslog.txt 2>&1
  2⤵
  PID:1680
- - C:\Windows\system32\netsh.exe
    netsh wfp show sysports file=config\sysports.xml
    3⤵
    PID:1672

C:\Windows\system32\wevtutil.exe
wevtutil epl "Microsoft-Windows-WLAN-AutoConfig/Operational" config\WLANAutoConfigLog.evtx
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Windows\system32\wevtutil.exe
wevtutil al config\WLANAutoConfigLog.evtx
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Windows\system32\netsh.exe
netsh wlan show all
1⤵
PID:312

C:\Windows\system32\netsh.exe
netsh lan show interfaces
1⤵
PID:1656

C:\Windows\system32\netsh.exe
netsh lan show settings
1⤵
PID:564

C:\Windows\system32\netsh.exe
netsh lan show profiles
1⤵
PID:1016

C:\Windows\system32\ipconfig.exe
ipconfig /all
1⤵
- Gathers network information
PID:2964

C:\Windows\system32\certutil.exe
certutil -v -store -silent -user My
1⤵
PID:2680

C:\Windows\system32\netsh.exe
netsh advfirewall monitor show firewall
1⤵
- Modifies Windows Firewall
PID:2932

C:\Windows\system32\netsh.exe
netsh advfirewall monitor show consec
1⤵
- Modifies Windows Firewall
PID:2520

C:\Windows\system32\netsh.exe
netsh advfirewall firewall show rule name=all verbose
1⤵
- Modifies Windows Firewall
PID:2036

C:\Windows\system32\netsh.exe
netsh advfirewall monitor show firewall rule name=all
1⤵
- Modifies Windows Firewall
PID:1812

C:\Windows\system32\netsh.exe
netsh advfirewall monitor show consec rule name=all
1⤵
- Modifies Windows Firewall
PID:832

C:\Windows\system32\wevtutil.exe
wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity" config\WindowsFirewallConsecLog.evtx
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\system32\wevtutil.exe
wevtutil al config\WindowsFirewallConsecLog.evtx
1⤵
PID:1936

C:\Windows\system32\wevtutil.exe
wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose" config\WindowsFirewallLogVerbose.evtx
1⤵
PID:2708

C:\Windows\system32\wevtutil.exe
wevtutil al config\WindowsFirewallLogVerbose.evtx
1⤵
PID:2688

C:\Windows\system32\wevtutil.exe
wevtutil al config\WindowsFirewallConsecLogVerbose.evtx
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\system32\sc.exe
sc query wcncsvc
1⤵
- Launches sc.exe
PID:2920

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1104811070-18222302921573332388-1857654419654483136-488261696341329933-1829524728"
1⤵
PID:2696

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-14647916971533610365-1888879270-16240889661653553455437168006-952579447767501158"
1⤵
PID:2036

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1915387591-15613442241494017004-1225954497-1893354131-11717383871447228852-444352554"
1⤵
PID:1016

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1633396472-2892664520884508932016002431-1531489718-1588076772780773667-1027503580"
1⤵
PID:2464

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-9665019532361561931953907432-46926642-5104998120458558551608821794455714815"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "20623048241730269003-1726886044615768906-439109190-79874613-314526873702044485"
1⤵
PID:2732

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "19565366228279858091846952813373633151-866470353590829411755449068-43381457"
1⤵
PID:2636

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-32351320619981877671390921389-177783153115030854824584374831039008546306354397"
1⤵
PID:664

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1178099664-147530672-13238007451212721988-22493806216876437461292411080131774999"
1⤵
PID:548

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-12210771241994455466-1572351394-732251521819503132-2085656187623218251-928296443"
1⤵
PID:2932

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-20614529811390086395-2090396168-18468808652122457969-1678623334543099401382702280"
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\config\Dns.txt

Filesize
25B

MD5
dbbe6a0d6c5d16e1f1b3f1a0a02640ab

SHA1
ec26045f7867ff5b47edf76ad014fe584243d8ce

SHA256
c6226537e8f06c6916bdf4a19662d28feb21e249c39f41be615b6894c603eb60

SHA512
76dd015a4710c5f2fa9a1ac606e02d40b56595c22e10b8e9f1b9f2f2b57a94f243214ce0026f2d363e4a61ad6fd373e40fdcd7b8f24f747d286124787f3d87ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\Dns.txt

Filesize
2KB

MD5
a7409bce92ebba69939fd68f6d557442

SHA1
a16c23fedb735e7ca9adae9ef79356b4fa771dfc

SHA256
34a54f9c62f27fa39b6e8f2e1671bf59efd6f6e5896d5165532c29f96ee3ab58

SHA512
d8443ade54e8aeb6c7ecd4a99f9c078ae0bf6a5e70882c38e510d8c3085b1792a2788c93294390eefb1321ea7476e6d7377218db2aca1f4b5ce9967c9ed75a01

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\Dns.txt

Filesize
2KB

MD5
de47cb8e62cc4410bfd0558061a5d05c

SHA1
eb158b15cfccbf3499ffdeaafe22eea818cb558a

SHA256
0de3ffddfb8cda867f11ef70bb61bf60056babf509f022cbcb5640a439a254e7

SHA512
8d5104746e13c9689aa2e755159c57371b975eec572e69d846bfd3234597a557425ca84776bd311ee8943646fd5e2f120b3af7e9e43837c2772f56f3656eb1c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\Dns.txt

Filesize
2KB

MD5
de47cb8e62cc4410bfd0558061a5d05c

SHA1
eb158b15cfccbf3499ffdeaafe22eea818cb558a

SHA256
0de3ffddfb8cda867f11ef70bb61bf60056babf509f022cbcb5640a439a254e7

SHA512
8d5104746e13c9689aa2e755159c57371b975eec572e69d846bfd3234597a557425ca84776bd311ee8943646fd5e2f120b3af7e9e43837c2772f56f3656eb1c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\Dns.txt

Filesize
2KB

MD5
8e997aac395cf211822ef7959f36d099

SHA1
3ee54920a7761a8379b8c646013bb651492e10fb

SHA256
583e0ac9fd3c77c07c8d76bba850e791304d3cd787abecb0786ebe95c91eaa6d

SHA512
da29f7b57293278f0155f44dce602fe3e3c2750c965dea79b8b1a447c76e1e4e1636b084668e1c3f4877e9264effc9be512cc8ac30f73484ab52e82436210ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\Dns.txt

Filesize
2KB

MD5
36c810feab7763074a00770fd9383022

SHA1
62be3bb7d4a50856b6563675b08c366ff87e79be

SHA256
04de07ca6d5acf9441fa063241bfebf9947acce89a66f980cc26781ead5ccc12

SHA512
73ed8f3c0b15b094bceaeb466f5caecfb224bc2806b3cd7eac8baa39b0c45910e141697f238815c8d62787e1a7acd5d079a0cc783245cceb2e264a92358a8a8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\Dns.txt

Filesize
2KB

MD5
36c810feab7763074a00770fd9383022

SHA1
62be3bb7d4a50856b6563675b08c366ff87e79be

SHA256
04de07ca6d5acf9441fa063241bfebf9947acce89a66f980cc26781ead5ccc12

SHA512
73ed8f3c0b15b094bceaeb466f5caecfb224bc2806b3cd7eac8baa39b0c45910e141697f238815c8d62787e1a7acd5d079a0cc783245cceb2e264a92358a8a8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\Neighbors.txt

Filesize
10B

MD5
680c0f5b43ef4736633cddb32b417a2d

SHA1
ce18efc8ffd6d94f643faef43680d2d105d15cba

SHA256
48d49298867ff9049f8ad01db758a1ef4adc71b5ca2bd5aaa8cdd89806334a23

SHA512
31a6c84e0303364d1a972ea7ce73d22286050b5bcede8c998b10fdebb225505cb740c6d8cc75923977f9f16ab76b8e1aa8967231b50496a7540e64a496c13091

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\Neighbors.txt

Filesize
564B

MD5
c96535be3b609320bf206ae61f5ec862

SHA1
d4cb6c911849d0c7426f508917098ad62804f598

SHA256
4287613c5920bf340390c645092404a333d5cad86baf6816ad83130f8bd38c06

SHA512
50a89d5b1a8568c671f3066664de9375768122c3207aabf68e1caef50229eda5e0d1e08ba294cc10ad602e06a99bc03fbd2d61e80a6f1e2a26338a5b2a74b8cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\Neighbors.txt

Filesize
597B

MD5
21e29809134a6ff0fa4e33351245e4fd

SHA1
47a9a600f9076f56d5216fde6238d7edbb54f714

SHA256
02eae620050afc6f63cdd86eca153a5f5ca8a6de5b50f0d5de40fa3a5e8e7043

SHA512
399ac3b848b5aea4349e27042597c7bfd7de5dcb66e5cfe0157a5c62d4dbd906331f3be6372bfe87acc437c62fe61c764b3b977335d8d17eb64aa3f285a85125

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\Neighbors.txt

Filesize
597B

MD5
21e29809134a6ff0fa4e33351245e4fd

SHA1
47a9a600f9076f56d5216fde6238d7edbb54f714

SHA256
02eae620050afc6f63cdd86eca153a5f5ca8a6de5b50f0d5de40fa3a5e8e7043

SHA512
399ac3b848b5aea4349e27042597c7bfd7de5dcb66e5cfe0157a5c62d4dbd906331f3be6372bfe87acc437c62fe61c764b3b977335d8d17eb64aa3f285a85125

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
180B

MD5
e9d9c70311e468c5ac1e313ea317e31f

SHA1
3ec7e470b8e8a747dff0b312afbe8f9f859fdb56

SHA256
f89da86624bb8f26a5b624932253966dc7cd97ce87eeacf19ed9cc8c77f650be

SHA512
644e4d6b2fe77af31ae29b48a6d46761e3a4cacd1f979bd25994051cc8280b218f7bd6512eb592a11f2b65554551887dde988d264b1e0e215198539d060c1582

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
455B

MD5
11331075e463e6cc232419d9c5a23945

SHA1
2ac8dd5fda25ff577ad32020d417ee7218abb0da

SHA256
5a84886b89430498df9ef0c57b8e982ffbdbd07000678fd94093feec9343fe52

SHA512
eaca25d1656d70b6e7e125476e40ba53cad085da432328b0a8303d4c332b03c37d1fc8b5073f526b8183d18db07f76cc6399ed95255f41f52a9dd89120ee1c74

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
730B

MD5
070b4dc5ec850f127b71640bdedb85fe

SHA1
ce294d70ba4a000af61c371a698cc72c9f9d0142

SHA256
c6d65dda676758f2018c2d4a6bf364e41bb28dd46c63a2ff28f81e1ccf494154

SHA512
2f6afe868eca63eecfea7ba24a4a2a02c68ab368d66f803614a03c915b46d5fad747a657566024ae8de2176be7c825b42831a64f0e338dfeb5317edab34582c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
1005B

MD5
546d39bed845e9fd72c48c29a681c6e1

SHA1
d8b1070f02a4160a055e862f9ef5fe1b5c2e69ab

SHA256
7b06f66f91635a37fd2c8a6215c120cd536ad1acff45769c244cd8b1e2d27316

SHA512
235a0cee797c5db5bfba51ea71784b34c13970f19a9075fcb14a363e9e698c43f912dee7cf00fbd33d6c6f52679388582a432c3e330e5044a19c21ac4d040ab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
1KB

MD5
239dab30605b95605fd9b6a6ec9740b7

SHA1
98ee462fe202a0f9f12aafeb8f044b0d9b5b7ad0

SHA256
0c25e9f59d1b2db5fc59cf926836a90d07b575ab15f63f88171cf783465a7287

SHA512
e7ad7c277d9deb914a2c7dd83f5b0fc5380703bfb28407d9e3be856e17fd501a9c577dbf9ff0a725048fe9a1a96c0a62503888dca32b6bd9892334029190c9e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
1KB

MD5
471755c211cd2a6d9dac12c97cca74b8

SHA1
4ed2b8dbf4789c641abc6cb8694d810973d8f224

SHA256
9ddce13768515a1efd99c23b0b8df4241b6a797a441003a39c94f76d85d2042f

SHA512
131ef906f0e72c6496fa233d07594e95c344119aa5b6dbc33caa2a2714d5ab8ff5d6f6c608ce26abed0f489c3c9d338446112b46ed70cae7ae1aaa2161513ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
1KB

MD5
34aaec8e266e676ba30d2e8c43134314

SHA1
b54b6d96d79c74f9d184233b310d564f77ff0075

SHA256
6e99ddb93b1ed2e6d8a0a79da6c024771d2a1836c3d3d0f76b2061d7ead0deec

SHA512
641f36a4c9e8736fdb21f1aa7bc234da30b4dfcbde6836b1058c17e21efa812104fab5215907577e1dc0bb6818311e7f43fecef89d4678ad14749479d17baa85

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
11KB

MD5
3c526e9df0112f41478d9e518c8dc554

SHA1
048b70ee07c5b83205ffb212fae82e8179959ec0

SHA256
f1584be06e6379ea9cc0746aa8498856f25ea24065f5b7a59c5116734d6f724e

SHA512
f9cc3d52a971907fa4f93cf14219412e9e886889bd2b4c7737091e8866edab2d79cee06e36aee209090f54fcc540fc522c28ffefc4431356e7f5d05d9688f59c

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
13KB

MD5
9438cfc4a379b276090ed28296272ced

SHA1
587fc283d55acc67a27b23a3e594b716dfabe36f

SHA256
43ad2708a056c79d9943f7277c237be5a2340745d52d61f854b09e78746af436

SHA512
15f228d7b2c8583d506a5b6a3249917a656164564d660ab07248de226029b189ca2a9e9b58bcec5a90e3e0faf762845f46a90861c12a147eae476fb886dae2ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
13KB

MD5
9438cfc4a379b276090ed28296272ced

SHA1
587fc283d55acc67a27b23a3e594b716dfabe36f

SHA256
43ad2708a056c79d9943f7277c237be5a2340745d52d61f854b09e78746af436

SHA512
15f228d7b2c8583d506a5b6a3249917a656164564d660ab07248de226029b189ca2a9e9b58bcec5a90e3e0faf762845f46a90861c12a147eae476fb886dae2ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
13KB

MD5
3e2c6b37efbfab3d5f36db1e2131cbb0

SHA1
e669ae216a0099f98736c50d0e52648ac4e1d96f

SHA256
c469bbc67497f51cbf4a031ab6f4f57c477166724f4b423cc0067626dc7e486e

SHA512
19651831fc2743fb9772ec0c9b9aa2aff010080a941c112d49eb9983c172ac5d393c8cd933fff7aabcb6afeba1c592dbea101af5b62e7360e9d424647bfed29b

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
13KB

MD5
b762c1b379f6a4696997f2a5b5ed9196

SHA1
722227f1b99f1f5fb41fdbfcb75ce24ab250618c

SHA256
e90df8fc2b460caf41a3379b744f0d7f72e3ea25aaa484f3991305ca74a55220

SHA512
56478ac401bc00e310d305d08910a478b49b7fc98b539c7548d7b1a5ea8ed7d15bed1869e44ed12d36212afa3a3799ad2ac9c617e9d25e86bac54584542ab620

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
13KB

MD5
b762c1b379f6a4696997f2a5b5ed9196

SHA1
722227f1b99f1f5fb41fdbfcb75ce24ab250618c

SHA256
e90df8fc2b460caf41a3379b744f0d7f72e3ea25aaa484f3991305ca74a55220

SHA512
56478ac401bc00e310d305d08910a478b49b7fc98b539c7548d7b1a5ea8ed7d15bed1869e44ed12d36212afa3a3799ad2ac9c617e9d25e86bac54584542ab620

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
13KB

MD5
a248dabaf15be40c8bbf59fec24d768c

SHA1
41278925bfc5077c1f275d5158b3ad71750e9934

SHA256
eb157fef544012261fece7e6b48f86994fdfb5f84537b560019d8bab4513a105

SHA512
1c7cd9e97d0307f1aa207bd32a98bf76c13c08d8b354787ff33d0388749b87dfece5ea9096e6860cff438bab7272e3a8e0ded2c51bf6a2f133180b3f9e4214db

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
13KB

MD5
0a21a76d7e3585fd685040d42fc27932

SHA1
4bcf1f23db6e3364fb5870a3e020ac6c329f2e06

SHA256
d3573254935f804e04a2022ff579c3d6c9dc102fc816129affcdac3a08234a60

SHA512
a2f2889b6e8a628823045295c522617e683bfe5dbd46919da0bc3cdc67cd5c75c3989519d915ad62fe7adc4ffad1c444c4ea072110941bcd1376da9f4f782777

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WcnInfo.txt

Filesize
13KB

MD5
e5fac385e3fd6d7b024ce441c546699a

SHA1
bac945febce0ddfbf7cbc134e749a0ddc3416fb7

SHA256
39a86854ebda40b8de367e30821b6a5a8a6051bbebb39e8044728b1405e69e4d

SHA512
4d33ec4f2066603b5b67feed6931526f760c9d4fc2c006e129d10fdf8336ec2b4499f4c5aaf0f370915417fefd530d6cd4bc09adda44a6e2fd9528ac9e90c11d

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

Filesize
95B

MD5
9b507b45c41b5b76ee28e9a236d2799b

SHA1
1faccb7a5024ec67e96277264d8accfad0882863

SHA256
d7d5617f0c7bc136c2c3c813b0aebdf9aa51fc4b660994abd17e843390b64d3c

SHA512
28dc0f4f1108150111873f10b43dbbb8c5e99f033f6708a8ce3eed0038ec33fc6a0f48a76d07f468de7ab0e5d67321647c884c7551f7a418e5866151a506eb47

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

Filesize
95B

MD5
9b507b45c41b5b76ee28e9a236d2799b

SHA1
1faccb7a5024ec67e96277264d8accfad0882863

SHA256
d7d5617f0c7bc136c2c3c813b0aebdf9aa51fc4b660994abd17e843390b64d3c

SHA512
28dc0f4f1108150111873f10b43dbbb8c5e99f033f6708a8ce3eed0038ec33fc6a0f48a76d07f468de7ab0e5d67321647c884c7551f7a418e5866151a506eb47

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

Filesize
269B

MD5
0c99db4ea1299da39f74379772611286

SHA1
d44af745d19c1903429643342083959e63ad6d76

SHA256
28ba2effafd3cbf220aeaf18f11f372f7b8b6488e7e4467efec9d1e2bba2ce5c

SHA512
b9318720a5d2ab3dd6cc51a8d0f83f2145ed466fc156c191dd62b744b5b4c23ba669b3ccc0167ae47339b9e43f38438dad9b645d98e3f0b1519d56fb51d85a0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

Filesize
344B

MD5
e0fedf98a0859224fea3d5c58c7a9203

SHA1
5792f4561c103e660cc35d0a1d0a05695e5a2879

SHA256
8c62de583360a6e8e86c8de6bc33347f3c998f8849176663b02d8f53eaf8ac43

SHA512
9208984ac1fa1706c5476ba08404718d5360ce222e47e46493312000e250b31e6ac123e673d1bfe893eafbd4221f5637a7530f5287bebf11bdf81ed4ff8af49a

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

Filesize
344B

MD5
e0fedf98a0859224fea3d5c58c7a9203

SHA1
5792f4561c103e660cc35d0a1d0a05695e5a2879

SHA256
8c62de583360a6e8e86c8de6bc33347f3c998f8849176663b02d8f53eaf8ac43

SHA512
9208984ac1fa1706c5476ba08404718d5360ce222e47e46493312000e250b31e6ac123e673d1bfe893eafbd4221f5637a7530f5287bebf11bdf81ed4ff8af49a

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

Filesize
623B

MD5
b76fa41618ad1119ea6a03d0c748fe56

SHA1
e6e857be56919ec8c6ef532f6d324e42b3d6791e

SHA256
4b13f4ac8dce26fd89e379c71d2aad179a1701cb4abcb66938047eb3a2dacede

SHA512
6ce38c5c2d1b55a44ea1434ae55cbd7784317dabad87e9c8a28f9f30857d9deede4ef3b4d3d13bbb80f86d7804606fa21d78470b3826e17a63eb575a14152fee

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

Filesize
698B

MD5
6b06aa1ce0a2c0d2125acfaff7591bd5

SHA1
585853f6b76a8dd1a35aad6b25b6436a0250526b

SHA256
ae90c6a7f11fa209a88bd0e88281acc7e1a6cd4793c678168e72ccf6db724796

SHA512
957a0d38440cd102a91010b3622461811480de991d0a0b5f0c9f7c9aafdfebb954824bae20c1b853dea7a3703809b308ed7b56bc39b4ce59e311b44dc520e6ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

Filesize
698B

MD5
6b06aa1ce0a2c0d2125acfaff7591bd5

SHA1
585853f6b76a8dd1a35aad6b25b6436a0250526b

SHA256
ae90c6a7f11fa209a88bd0e88281acc7e1a6cd4793c678168e72ccf6db724796

SHA512
957a0d38440cd102a91010b3622461811480de991d0a0b5f0c9f7c9aafdfebb954824bae20c1b853dea7a3703809b308ed7b56bc39b4ce59e311b44dc520e6ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

Filesize
958B

MD5
fa70c0c76388ed7ec597187e12feb1f2

SHA1
f7a0b7a3a307d32460e91c9f36c592124bcc0341

SHA256
64ea5af499726361a0a4c7c31e6c2166a960666649448f88a599a8e0cb129e5e

SHA512
e01fdf6af774ffce476b94c2ba7b3cc20b88154f08f809c0662fc77377b789becdf998c6195dbd993dcc63dce0833d9a2e467271c85291fadc23f6cae06cef62

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

Filesize
1KB

MD5
7657e67bc70a5a90244ad44dc42107cf

SHA1
77ef972e7ef1ea4283db571a8c12c7818496cfcd

SHA256
28720c68ac798d34c306747c91b6f576743360463096833dd74f1addc9d6d242

SHA512
1bc009142b2dfccd3992ad62c731d8a68f0e6076ea9301935b29b522a37e7f1a56b14720036e87469688f075509d27428ded897f54565d0c59e225d2f71b0f83

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

Filesize
1KB

MD5
7657e67bc70a5a90244ad44dc42107cf

SHA1
77ef972e7ef1ea4283db571a8c12c7818496cfcd

SHA256
28720c68ac798d34c306747c91b6f576743360463096833dd74f1addc9d6d242

SHA512
1bc009142b2dfccd3992ad62c731d8a68f0e6076ea9301935b29b522a37e7f1a56b14720036e87469688f075509d27428ded897f54565d0c59e225d2f71b0f83

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

Filesize
1KB

MD5
3149e60c925b3e4eeb2afa18d221a7ec

SHA1
14b10324f85dcfbccd23cdf49f0f6d2d3b559c9a

SHA256
eb6811e21dc49b4a2218a9f3d44c83eec0e89488fb4340b75308d63f3a3f97cc

SHA512
673ce17238e9981a091d7f8c8761f905d722ff9994edbc7d6dadeb6442baea55138a8c0a29bf61b9e71f250ecd2273e57adb02c68f5db5e5d92e093b83c066aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

Filesize
1KB

MD5
3c3bfb6800aeab3caaf49a7632fff3bb

SHA1
805676e841b7ded8fe76b91bcdd5cb12204deb60

SHA256
2a36a69a436e4f3ac6b4739c47c572b551efbc74d0bd5146fb4f1ae74735c8cb

SHA512
2b997d344683d8a891df05b119921ea43a27285795d1eef52c61b4639e200c7b6a15b029f75e9fa97d2c3bd7204095da930c0b2547def84249774ee6a24b24ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallConfig.txt

Filesize
1KB

MD5
3c3bfb6800aeab3caaf49a7632fff3bb

SHA1
805676e841b7ded8fe76b91bcdd5cb12204deb60

SHA256
2a36a69a436e4f3ac6b4739c47c572b551efbc74d0bd5146fb4f1ae74735c8cb

SHA512
2b997d344683d8a891df05b119921ea43a27285795d1eef52c61b4639e200c7b6a15b029f75e9fa97d2c3bd7204095da930c0b2547def84249774ee6a24b24ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallEffectiveRules.txt

Filesize
113B

MD5
f922ce103305d2d2766cd69b4992bed4

SHA1
e43c5ec1882020e9f59bf8be1f7b039b7279aec9

SHA256
673712f1a5ddf23348ad5dd910c0fad7656d5c4b60f9d9d6b413aa7ed20f3612

SHA512
65b2dd117d6ac6d8589ebaf1c22d3dff59cc79887eb53e8951f53160b9cc6ecabecd2a32d0e54d4cf517258118ed48791d0e9f679b3e166974aaa18faff8112f

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallEffectiveRules.txt

Filesize
113B

MD5
f922ce103305d2d2766cd69b4992bed4

SHA1
e43c5ec1882020e9f59bf8be1f7b039b7279aec9

SHA256
673712f1a5ddf23348ad5dd910c0fad7656d5c4b60f9d9d6b413aa7ed20f3612

SHA512
65b2dd117d6ac6d8589ebaf1c22d3dff59cc79887eb53e8951f53160b9cc6ecabecd2a32d0e54d4cf517258118ed48791d0e9f679b3e166974aaa18faff8112f

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallEffectiveRules.txt

Filesize
407B

MD5
445273f6cb444643254868591238cb3f

SHA1
df0fccd4475453a9ce599105bc32d41dcc26c2c4

SHA256
322b29c363f0c96f7c0537f31aee08606d90c1f750af05a65beaca6a8d1e5d98

SHA512
82ac8c4c0da86646145fef16c65a51f2ab499fea90bd87cf6c553591402340983ecc051fa04c8585a0220c6c21f2e9a4f3a5b30d1083dba606c8c6d996656b7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallEffectiveRules.txt

Filesize
482B

MD5
8eaea0bd242613fabfdd0db2d5c35a69

SHA1
b534ded196120d8b34f8d72503ca548a88574734

SHA256
6339ea308fae5552302e96d5328b72f070452911d757b87e27b46db665595431

SHA512
2cc1a9349c507aaee258d0b545516f1f7b662d36111d15add4ae00ac6b55809128b46472e5254ed62688b93e8122a9aa686ab8467f04cc08a8b2629b98eed52f

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\WindowsFirewallEffectiveRules.txt

Filesize
482B

MD5
8eaea0bd242613fabfdd0db2d5c35a69

SHA1
b534ded196120d8b34f8d72503ca548a88574734

SHA256
6339ea308fae5552302e96d5328b72f070452911d757b87e27b46db665595431

SHA512
2cc1a9349c507aaee258d0b545516f1f7b662d36111d15add4ae00ac6b55809128b46472e5254ed62688b93e8122a9aa686ab8467f04cc08a8b2629b98eed52f

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

Filesize
2KB

MD5
efa45f7417c6fdd820f92eb9fe2ad385

SHA1
df06bb2c72cdfecb30ba4f2d7987af2132619956

SHA256
f4e2d341997019e19a12aae7bbe09a156e878735faaa3b84c54325f19cb81241

SHA512
64d5813ab2743a6f81bbc67fe7bc1934cabd1d54cceb0ad9fe6b81d108dd3bdfe31aa93f9cbe9caf5fb972443167bfaf22201abde71facc43f042d84d867275b

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

Filesize
2KB

MD5
c052db9713e718767e6c9db8f52ffe06

SHA1
38bacb9e9e69f6d0fd2d86bb2d8e8f74c2b81e28

SHA256
6d27b33e5f2f8dff0ff618db23377ef91a5abf688318fb1b2d4901c01ad93fbb

SHA512
e61589159f42f8e20c046d2af01af95b2975636bffede352972cc69c50fadd4d00e6f428514d120487b82d80373bf1c3b4ace68bd5c20277ed78d0039b79a192

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

Filesize
2KB

MD5
c036c551230385531d8cb29b9fa2b2e9

SHA1
1f83e29b4ad5f3b8a82672f2679af8f090d773c3

SHA256
0bff62c11bf9ccb1ee30a3f942dcc16612128d3ed8584d2f4d36bd695884cbeb

SHA512
f7be0687ab69bbc5f209a313b2634444336b2edfe72ad6a456bc93699623232363cd5a87ce1496c110e0e8838a684bc02985df3d8f99e4f40c1e02e6522151f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

Filesize
2KB

MD5
3e8e5b08f236e5b712ec9ddffc108e99

SHA1
5427399bd87a32640f41e321e8b2e7c5e8f21039

SHA256
1da4824ceda35c99c35c2af1399133aa5919baf3bee09e6c2be0d63e06238e8b

SHA512
063d34fd50d25892d76294bf405b44f58b6e1f53e3fba8d81e1ea18b278401ff8b5ef819f6de53b24bf9a3835a5f891bb46e07d5747dfe586c70c89469d403ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

Filesize
4KB

MD5
ad5fcaf463d0e954540906e4970613f7

SHA1
1fd1578991790e9cc23e4b898dbddea1cfe74f04

SHA256
f6f3d21ca69f58cf65cf6f6cef8d151b225a7c171ac1a043e5962d099c25be57

SHA512
12a3b0643c193f6718b2006eed19ad2aefbcdcee49b234b141e9710a80121f20c66c8c46541aa7784c1e18a595ec07897af217221bb29540e93e8a1025a2663e

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

Filesize
4KB

MD5
029a13745e068d043ad9a337acc864e0

SHA1
107f30d27ffeddabb007c7ddd272c7772a41ac7a

SHA256
81ff9d87abd03cfd0039b1a982df30c8c2f248c5019434c2e346b8d08c23aadf

SHA512
c6ce5c3e62a2c04058ea6c475025faac9d5e5e100b8b86787417d0664a34448309c298c7ebd2dfdb798c9d132763a54ff6c79247111a4ae0358b7fcb55d9e6a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

Filesize
4KB

MD5
029a13745e068d043ad9a337acc864e0

SHA1
107f30d27ffeddabb007c7ddd272c7772a41ac7a

SHA256
81ff9d87abd03cfd0039b1a982df30c8c2f248c5019434c2e346b8d08c23aadf

SHA512
c6ce5c3e62a2c04058ea6c475025faac9d5e5e100b8b86787417d0664a34448309c298c7ebd2dfdb798c9d132763a54ff6c79247111a4ae0358b7fcb55d9e6a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

Filesize
6KB

MD5
ea2d7b6cc71f046cf0eb580923129857

SHA1
bb96ab556f1b63d7ca88dd72a541a5db7759611a

SHA256
cea43fe19fe855ac70d8f77d4c5515155777cdcf05847b888ef2123288d897c0

SHA512
7004818b59da86dc7b1582d514d377e74a969f7e9b869c4fa53f754d14be58876bb6bd7af6df665215087789748b05865e58444d27869dd51179725e6eb4fea3

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

Filesize
6KB

MD5
ea2d7b6cc71f046cf0eb580923129857

SHA1
bb96ab556f1b63d7ca88dd72a541a5db7759611a

SHA256
cea43fe19fe855ac70d8f77d4c5515155777cdcf05847b888ef2123288d897c0

SHA512
7004818b59da86dc7b1582d514d377e74a969f7e9b869c4fa53f754d14be58876bb6bd7af6df665215087789748b05865e58444d27869dd51179725e6eb4fea3

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

Filesize
6KB

MD5
ea2d7b6cc71f046cf0eb580923129857

SHA1
bb96ab556f1b63d7ca88dd72a541a5db7759611a

SHA256
cea43fe19fe855ac70d8f77d4c5515155777cdcf05847b888ef2123288d897c0

SHA512
7004818b59da86dc7b1582d514d377e74a969f7e9b869c4fa53f754d14be58876bb6bd7af6df665215087789748b05865e58444d27869dd51179725e6eb4fea3

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

Filesize
6KB

MD5
7675270e9c00c2845859b00e626eb4c3

SHA1
c2bc2397905d45f50551fd25a515a7bea5d255ea

SHA256
b7731b1600756f6c3da0ebf2258dc80ae4112ab3892ed666cc7d6801e46cfa3e

SHA512
c5ce0395a40f1824054391edc6d2951af243f74fa8f55e70f0ebf78f841c72c1f90229027669e57abf09d8d79df4a65e8b3463e585c3a605234c058a968c673b

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\envinfo.txt

Filesize
6KB

MD5
7675270e9c00c2845859b00e626eb4c3

SHA1
c2bc2397905d45f50551fd25a515a7bea5d255ea

SHA256
b7731b1600756f6c3da0ebf2258dc80ae4112ab3892ed666cc7d6801e46cfa3e

SHA512
c5ce0395a40f1824054391edc6d2951af243f74fa8f55e70f0ebf78f841c72c1f90229027669e57abf09d8d79df4a65e8b3463e585c3a605234c058a968c673b

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\netiostate.txt

Filesize
235B

MD5
ce9b212f0664a02869ad22567948e855

SHA1
eb2f569033e7ce112e07a67dae005c1540f240b2

SHA256
7615be2f16750a3b49600fc4490a7d3d5234a9d101dd05e2e4a07f454a16f1e8

SHA512
3fa857f337127d1742ea0a7ed9cdc0766f5487da4d1779364b548e84a8813868d5c35c20870e6e91c98aefb3107336239d8d7e283b89b0e56b1c4bf2bdbe93a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\netiostate.txt

Filesize
237B

MD5
d31176316a105bc00a95dc6214d78eb6

SHA1
ecfaab90e8db60610647323cd28a018d882d36bd

SHA256
e24f96354416537eb72d123e12f9cafdf7f2fd624ed52fd51112800913613199

SHA512
72b355af3bfffb84e17e00a0123b96f395d223ade286bbc03b1f4dc817ecfad5908e840d13367b281fb2198ca0bbfdb42dbdbfd37a2934d1963d214a3c519b3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\osinfo.txt

Filesize
187B

MD5
a296a4233e07760e59d0f979d6bce642

SHA1
255a632d598e3654c87f0cce3d6b53c464b6770f

SHA256
b6acdc07538b4893dc6203e18805996d08d12de895062f34d95497faa6d25e0b

SHA512
b6a6efb5e082fdd97a1ad36483c0a5bbc7f183a1a06a2ff0f504862fb4f2e1bacf3d03b946a4408d34c761a450eceb85c25153c9819bb7436793ec459509a769

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\osinfo.txt

Filesize
223B

MD5
3839b4ef0a60449d0b916cb858f8e6ab

SHA1
47fd428a8a9ec91316c0248dcf9fb117f628f860

SHA256
d37f6aeea9f98bfcf587cf593085d0614624b61df220adc3657a89457169e259

SHA512
bda997f0cf01155b30332bb5b70873b6c863b10ffce87972b97a64fd8f38802be135520a23cab4226744abb51818d437b557fb87f2bfb936746df1145322c8e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\osinfo.txt

Filesize
1KB

MD5
91a3e1c668da59acd955698518bf899d

SHA1
f5dc8a9defbcc4035c4d18d28132a40ed69e1444

SHA256
e094985b46f505ee89a7c28ed67cfe9afa66e2847c42f177ac2341cf5eeef6e5

SHA512
8586f20a1ecce1088b7f985c0a27c924d68c8440b5038dd18655c815f23abe173a9a814a04bb9f47d862838a7db4122cd25b11bd41c1974f61457cbf604455bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\osinfo.txt

Filesize
3KB

MD5
0c7269a432995e986957372bf6699e4e

SHA1
abccd887a85a2e3fa715f1dac71e10dc250eeb07

SHA256
32ba8eedfff954ed723dab6420965e7079e181f61b30d02ed365b1e405eaa1aa

SHA512
a416f81195150527364a20e763c86d4082f9360165c7c870c243e3e200b277ac6944ce74c2a151348033b904cc216cc3787bb75649d93a92b40a1da6913c6998

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\osinfo.txt

Filesize
3KB

MD5
54451dbaeaafffb660e1bc378b0415cb

SHA1
de5826e8cc957609f282b657846f3b1e7352154d

SHA256
76184d4249d10cec2f799f216e377adbee9143a7219a7dc059aaad7d5395e34b

SHA512
532ed5964f52d4b88d9ba6d4dc2c7587c72806bb6fd045b5767ea002a4592ade1cf5ba719102fac7e41f10cfe5841ae6592b750a4f0734e19ca10d5e005e85c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tempfile.txt

Filesize
2KB

MD5
93304a25905b0fad5e0ded826dc8b164

SHA1
d5e752594b93257c43504cc09b8b8c36aec8841e

SHA256
6d9addd49371072c03584fa5f5a6e403b3b1a8c3d4a1c416f71c7b52ccc8f189

SHA512
13fb1793ef4ad94535cb79d301c1e4cee358c2d3871974fbdb19f9e115e5a0163b980aca3f76c73ac12eb4176630e58eb9d6fd0e3a6def1a306de581bb49edbd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads