b788983ec5db4507a9b73ea4db216a4b587dec87470d3ebbac6410410f6898aa

Analysis

max time kernel
116s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
26/04/2024, 00:57

Sharing

Reason

Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-26T00:59:50Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win11-20240412-en/instance_12-dirty.qcow2\"}"

Report Analysis Logs

General

Target

BlackFollow.exe
Size

11.9MB
MD5

ac77dc295569830549a3b55e66384319
SHA1

be4248b8891bf8156af8a1890093ca319e16b49c
SHA256

b788983ec5db4507a9b73ea4db216a4b587dec87470d3ebbac6410410f6898aa
SHA512

99445df6c86b250d25b7f2d5fe327b4303d1fa4360eb3d92c360492728aba06a84cf1e1d94bcdcb578d696ed7daf1d3a641b47300ae71b0d1af216437730362b
SSDEEP

196608:FhJQsQCvgWkEHvCcZMF0SUpOXdIN1WDLtdnZs64qAixvo6a+zry78rl3:rysQCYnefI0SUpO2WD/ZskxvdP2Yl3

Score

9^/10

evasion pyinstaller spyware stealer upx

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1816	netsh.exe
3244	netsh.exe
4032	netsh.exe
3420	netsh.exe

Executes dropped EXE 64 IoCs

pid	Process
5016	Windows Explorer.exe
2928	Windows Explorer.exe
1216	Windows Explorer.exe
1140	Windows Explorer.exe
1496	Windows Explorer.exe
4772	Windows Explorer.exe
3744	Windows Explorer.exe
3576	Windows Explorer.exe
1796	Windows Explorer.exe
1496	Windows Explorer.exe
5020	Windows Explorer.exe
1500	Windows Explorer.exe
1684	Windows Explorer.exe
1120	Windows Explorer.exe
3992	Windows Explorer.exe
3984	Windows Explorer.exe
2644	Windows Explorer.exe
3364	Windows Explorer.exe
2964	Windows Explorer.exe
2512	Windows Explorer.exe
996	Windows Explorer.exe
2192	Windows Explorer.exe
3480	Windows Explorer.exe
4952	Windows Explorer.exe
3884	Windows Explorer.exe
2324	Windows Explorer.exe
1048	Windows Explorer.exe
4988	Windows Explorer.exe
3684	Windows Explorer.exe
2104	Windows Explorer.exe
2928	Windows Explorer.exe
4772	Windows Explorer.exe
3976	Windows Explorer.exe
3124	Windows Explorer.exe
1276	Windows Explorer.exe
876	Windows Explorer.exe
1048	Windows Explorer.exe
4224	Windows Explorer.exe
3588	Windows Explorer.exe
4884	Windows Explorer.exe
2368	Windows Explorer.exe
3576	Windows Explorer.exe
3156	Windows Explorer.exe
1840	Windows Explorer.exe
4908	Windows Explorer.exe
3488	Windows Explorer.exe
972	Windows Explorer.exe
4616	Windows Explorer.exe
2064	Windows Explorer.exe
1364	Windows Explorer.exe
2324	Windows Explorer.exe
1116	Windows Explorer.exe
2548	Windows Explorer.exe
1604	Windows Explorer.exe
2304	Windows Explorer.exe
1696	Windows Explorer.exe
896	Windows Explorer.exe
936	Windows Explorer.exe
812	Windows Explorer.exe
1296	Windows Explorer.exe
4124	Windows Explorer.exe
2164	Windows Explorer.exe
760	Windows Explorer.exe
1168	Windows Explorer.exe

Loads dropped DLL 64 IoCs

pid	Process
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
2928	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
1140	Windows Explorer.exe
4772	Windows Explorer.exe
4772	Windows Explorer.exe
4772	Windows Explorer.exe
4772	Windows Explorer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2928-70-0x00007FFD1F8D0000-0x00007FFD1FEC0000-memory.dmp	upx
behavioral1/files/0x000100000002aa12-79.dat	upx
behavioral1/memory/2928-90-0x00007FFD38CA0000-0x00007FFD38CC4000-memory.dmp	upx
behavioral1/memory/2928-100-0x00007FFD3B1D0000-0x00007FFD3B1DF000-memory.dmp	upx
behavioral1/files/0x000100000002aa19-102.dat	upx
behavioral1/files/0x000100000002a9eb-105.dat	upx
behavioral1/files/0x000100000002aa11-111.dat	upx
behavioral1/files/0x000100000002aa1a-107.dat	upx
behavioral1/memory/2928-112-0x00007FFD35730000-0x00007FFD3575D000-memory.dmp	upx
behavioral1/memory/2928-113-0x00007FFD35700000-0x00007FFD35723000-memory.dmp	upx
behavioral1/files/0x000100000002a9f1-108.dat	upx
behavioral1/files/0x000100000002aa13-109.dat	upx
behavioral1/files/0x000100000002a9f0-106.dat	upx
behavioral1/files/0x000100000002aa15-118.dat	upx
behavioral1/files/0x000100000002aa1d-122.dat	upx
behavioral1/memory/2928-124-0x00007FFD35470000-0x00007FFD3553D000-memory.dmp	upx
behavioral1/files/0x000100000002aa1b-121.dat	upx
behavioral1/memory/2928-127-0x00007FFD21090000-0x00007FFD215B9000-memory.dmp	upx
behavioral1/files/0x000100000002a9f6-128.dat	upx
behavioral1/files/0x000100000002a9f8-133.dat	upx
behavioral1/files/0x000100000002a9f4-126.dat	upx
behavioral1/files/0x000100000002a9ea-120.dat	upx
behavioral1/files/0x000100000002aa10-136.dat	upx
behavioral1/memory/2928-138-0x00007FFD352B0000-0x00007FFD352C2000-memory.dmp	upx
behavioral1/memory/2928-140-0x00007FFD34D40000-0x00007FFD34E5C000-memory.dmp	upx
behavioral1/memory/2928-141-0x00007FFD306C0000-0x00007FFD306E2000-memory.dmp	upx
behavioral1/memory/2928-143-0x00007FFD2B1E0000-0x00007FFD2B22A000-memory.dmp	upx
behavioral1/memory/2928-144-0x00007FFD2B1C0000-0x00007FFD2B1D1000-memory.dmp	upx
behavioral1/memory/2928-147-0x00007FFD20990000-0x00007FFD21082000-memory.dmp	upx
behavioral1/memory/2928-150-0x00007FFD35F90000-0x00007FFD35FA5000-memory.dmp	upx
behavioral1/memory/2928-149-0x00007FFD36000000-0x00007FFD36019000-memory.dmp	upx
behavioral1/memory/2928-151-0x00007FFD34E60000-0x00007FFD34E74000-memory.dmp	upx
behavioral1/memory/2928-148-0x00007FFD3B1C0000-0x00007FFD3B1CD000-memory.dmp	upx
behavioral1/memory/2928-152-0x00007FFD34440000-0x00007FFD34457000-memory.dmp	upx
behavioral1/memory/2928-153-0x00007FFD2A0D0000-0x00007FFD2A0EE000-memory.dmp	upx
behavioral1/memory/2928-154-0x00007FFD29700000-0x00007FFD29738000-memory.dmp	upx
behavioral1/memory/2928-142-0x00007FFD306A0000-0x00007FFD306B9000-memory.dmp	upx
behavioral1/memory/2928-139-0x00007FFD34EE0000-0x00007FFD34EF4000-memory.dmp	upx
behavioral1/files/0x000100000002a9f5-131.dat	upx
behavioral1/memory/2928-119-0x00007FFD35540000-0x00007FFD35573000-memory.dmp	upx
behavioral1/files/0x000100000002a9ed-116.dat	upx
behavioral1/files/0x000100000002a9e5-115.dat	upx
behavioral1/memory/2928-114-0x00007FFD35580000-0x00007FFD356F6000-memory.dmp	upx
behavioral1/files/0x000100000002a9e6-104.dat	upx
behavioral1/memory/2928-103-0x00007FFD360D0000-0x00007FFD360E9000-memory.dmp	upx
behavioral1/files/0x000100000002a9ef-101.dat	upx
behavioral1/files/0x000100000002a9ee-95.dat	upx
behavioral1/files/0x000100000002a9ec-93.dat	upx
behavioral1/files/0x000100000002a9e9-89.dat	upx
behavioral1/files/0x000100000002a9e7-88.dat	upx
behavioral1/files/0x000100000002aa16-82.dat	upx
behavioral1/files/0x000100000002a9e8-77.dat	upx
behavioral1/files/0x000100000002aa18-67.dat	upx
behavioral1/memory/2928-246-0x00007FFD38C90000-0x00007FFD38C9D000-memory.dmp	upx
behavioral1/memory/1140-251-0x00007FFD1E430000-0x00007FFD1EA20000-memory.dmp	upx
behavioral1/memory/1140-252-0x00007FFD24840000-0x00007FFD24864000-memory.dmp	upx
behavioral1/memory/1140-253-0x00007FFD360C0000-0x00007FFD360CF000-memory.dmp	upx
behavioral1/memory/1140-255-0x00007FFD35CE0000-0x00007FFD35CED000-memory.dmp	upx
behavioral1/memory/1140-254-0x00007FFD223C0000-0x00007FFD223D9000-memory.dmp	upx
behavioral1/memory/1140-257-0x00007FFD20810000-0x00007FFD20986000-memory.dmp	upx
behavioral1/memory/1140-273-0x00007FFD1CE70000-0x00007FFD1CF8C000-memory.dmp	upx
behavioral1/memory/1140-274-0x00007FFD1FF60000-0x00007FFD1FF82000-memory.dmp	upx
behavioral1/memory/1140-277-0x00007FFD1FED0000-0x00007FFD1FF1A000-memory.dmp	upx
behavioral1/memory/1140-275-0x00007FFD1FF20000-0x00007FFD1FF39000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
24	discord.com
25	discord.com
26	discord.com
11	discord.com
12	discord.com
9	discord.com
10	discord.com
23	discord.com
27	discord.com
1	discord.com
8	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4248	sc.exe
2112	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000700000002a99d-7.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Collects information from the system 1 TTPs 2 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
3304	WMIC.exe
3900	WMIC.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3124	schtasks.exe
1940	schtasks.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2708	WMIC.exe
1748	WMIC.exe

Enumerates processes with tasklist 1 TTPs 10 IoCs

Process Discovery

T1057

pid	Process
3500	tasklist.exe
432	tasklist.exe
1992	tasklist.exe
2368	tasklist.exe
3448	tasklist.exe
388	tasklist.exe
2600	tasklist.exe
3172	tasklist.exe
1740	tasklist.exe
3576	tasklist.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2408	ipconfig.exe
1084	NETSTAT.EXE
1892	ipconfig.exe
4304	NETSTAT.EXE

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2484	systeminfo.exe
4000	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3272	powershell.exe
3272	powershell.exe
1808	powershell.exe
1808	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2708	WMIC.exe
Token: SeSecurityPrivilege	2708	WMIC.exe
Token: SeTakeOwnershipPrivilege	2708	WMIC.exe
Token: SeLoadDriverPrivilege	2708	WMIC.exe
Token: SeSystemProfilePrivilege	2708	WMIC.exe
Token: SeSystemtimePrivilege	2708	WMIC.exe
Token: SeProfSingleProcessPrivilege	2708	WMIC.exe
Token: SeIncBasePriorityPrivilege	2708	WMIC.exe
Token: SeCreatePagefilePrivilege	2708	WMIC.exe
Token: SeBackupPrivilege	2708	WMIC.exe
Token: SeRestorePrivilege	2708	WMIC.exe
Token: SeShutdownPrivilege	2708	WMIC.exe
Token: SeDebugPrivilege	2708	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2708	WMIC.exe
Token: SeRemoteShutdownPrivilege	2708	WMIC.exe
Token: SeUndockPrivilege	2708	WMIC.exe
Token: SeManageVolumePrivilege	2708	WMIC.exe
Token: 33	2708	WMIC.exe
Token: 34	2708	WMIC.exe
Token: 35	2708	WMIC.exe
Token: 36	2708	WMIC.exe
Token: SeDebugPrivilege	1740	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3988	WMIC.exe
Token: SeSecurityPrivilege	3988	WMIC.exe
Token: SeTakeOwnershipPrivilege	3988	WMIC.exe
Token: SeLoadDriverPrivilege	3988	WMIC.exe
Token: SeSystemProfilePrivilege	3988	WMIC.exe
Token: SeSystemtimePrivilege	3988	WMIC.exe
Token: SeProfSingleProcessPrivilege	3988	WMIC.exe
Token: SeIncBasePriorityPrivilege	3988	WMIC.exe
Token: SeCreatePagefilePrivilege	3988	WMIC.exe
Token: SeBackupPrivilege	3988	WMIC.exe
Token: SeRestorePrivilege	3988	WMIC.exe
Token: SeShutdownPrivilege	3988	WMIC.exe
Token: SeDebugPrivilege	3988	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3988	WMIC.exe
Token: SeRemoteShutdownPrivilege	3988	WMIC.exe
Token: SeUndockPrivilege	3988	WMIC.exe
Token: SeManageVolumePrivilege	3988	WMIC.exe
Token: 33	3988	WMIC.exe
Token: 34	3988	WMIC.exe
Token: 35	3988	WMIC.exe
Token: 36	3988	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2708	WMIC.exe
Token: SeSecurityPrivilege	2708	WMIC.exe
Token: SeTakeOwnershipPrivilege	2708	WMIC.exe
Token: SeLoadDriverPrivilege	2708	WMIC.exe
Token: SeSystemProfilePrivilege	2708	WMIC.exe
Token: SeSystemtimePrivilege	2708	WMIC.exe
Token: SeProfSingleProcessPrivilege	2708	WMIC.exe
Token: SeIncBasePriorityPrivilege	2708	WMIC.exe
Token: SeCreatePagefilePrivilege	2708	WMIC.exe
Token: SeBackupPrivilege	2708	WMIC.exe
Token: SeRestorePrivilege	2708	WMIC.exe
Token: SeShutdownPrivilege	2708	WMIC.exe
Token: SeDebugPrivilege	2708	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2708	WMIC.exe
Token: SeRemoteShutdownPrivilege	2708	WMIC.exe
Token: SeUndockPrivilege	2708	WMIC.exe
Token: SeManageVolumePrivilege	2708	WMIC.exe
Token: 33	2708	WMIC.exe
Token: 34	2708	WMIC.exe
Token: 35	2708	WMIC.exe
Token: 36	2708	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 5016	2192	BlackFollow.exe	80
PID 2192 wrote to memory of 5016	2192	BlackFollow.exe	80
PID 2192 wrote to memory of 2180	2192	BlackFollow.exe	81
PID 2192 wrote to memory of 2180	2192	BlackFollow.exe	81
PID 5016 wrote to memory of 2928	5016	Windows Explorer.exe	82
PID 5016 wrote to memory of 2928	5016	Windows Explorer.exe	82
PID 2928 wrote to memory of 3588	2928	Windows Explorer.exe	83
PID 2928 wrote to memory of 3588	2928	Windows Explorer.exe	83
PID 2928 wrote to memory of 2904	2928	Windows Explorer.exe	85
PID 2928 wrote to memory of 2904	2928	Windows Explorer.exe	85
PID 2928 wrote to memory of 3168	2928	Windows Explorer.exe	163
PID 2928 wrote to memory of 3168	2928	Windows Explorer.exe	163
PID 2928 wrote to memory of 1572	2928	Windows Explorer.exe	87
PID 2928 wrote to memory of 1572	2928	Windows Explorer.exe	87
PID 2928 wrote to memory of 2764	2928	Windows Explorer.exe	88
PID 2928 wrote to memory of 2764	2928	Windows Explorer.exe	88
PID 3168 wrote to memory of 3988	3168	cmd.exe	93
PID 3168 wrote to memory of 3988	3168	cmd.exe	93
PID 2904 wrote to memory of 2708	2904	cmd.exe	94
PID 2904 wrote to memory of 2708	2904	cmd.exe	94
PID 2764 wrote to memory of 1740	2764	cmd.exe	143
PID 2764 wrote to memory of 1740	2764	cmd.exe	143
PID 2928 wrote to memory of 2752	2928	Windows Explorer.exe	97
PID 2928 wrote to memory of 2752	2928	Windows Explorer.exe	97
PID 2752 wrote to memory of 3600	2752	cmd.exe	154
PID 2752 wrote to memory of 3600	2752	cmd.exe	154
PID 2928 wrote to memory of 3680	2928	Windows Explorer.exe	100
PID 2928 wrote to memory of 3680	2928	Windows Explorer.exe	100
PID 2928 wrote to memory of 3684	2928	Windows Explorer.exe	101
PID 2928 wrote to memory of 3684	2928	Windows Explorer.exe	101
PID 3684 wrote to memory of 3576	3684	cmd.exe	164
PID 3684 wrote to memory of 3576	3684	cmd.exe	164
PID 3680 wrote to memory of 3084	3680	cmd.exe	105
PID 3680 wrote to memory of 3084	3680	cmd.exe	105
PID 2928 wrote to memory of 812	2928	Windows Explorer.exe	106
PID 2928 wrote to memory of 812	2928	Windows Explorer.exe	106
PID 812 wrote to memory of 2496	812	cmd.exe	108
PID 812 wrote to memory of 2496	812	cmd.exe	108
PID 2928 wrote to memory of 2092	2928	Windows Explorer.exe	109
PID 2928 wrote to memory of 2092	2928	Windows Explorer.exe	109
PID 2092 wrote to memory of 4940	2092	cmd.exe	111
PID 2092 wrote to memory of 4940	2092	cmd.exe	111
PID 2928 wrote to memory of 4704	2928	Windows Explorer.exe	112
PID 2928 wrote to memory of 4704	2928	Windows Explorer.exe	112
PID 4704 wrote to memory of 3124	4704	cmd.exe	114
PID 4704 wrote to memory of 3124	4704	cmd.exe	114
PID 2928 wrote to memory of 3508	2928	Windows Explorer.exe	115
PID 2928 wrote to memory of 3508	2928	Windows Explorer.exe	115
PID 3508 wrote to memory of 1940	3508	cmd.exe	117
PID 3508 wrote to memory of 1940	3508	cmd.exe	117
PID 2928 wrote to memory of 3460	2928	Windows Explorer.exe	118
PID 2928 wrote to memory of 3460	2928	Windows Explorer.exe	118
PID 3460 wrote to memory of 432	3460	cmd.exe	120
PID 3460 wrote to memory of 432	3460	cmd.exe	120
PID 2180 wrote to memory of 1216	2180	BlackFollow.exe	121
PID 2180 wrote to memory of 1216	2180	BlackFollow.exe	121
PID 2180 wrote to memory of 3232	2180	BlackFollow.exe	122
PID 2180 wrote to memory of 3232	2180	BlackFollow.exe	122
PID 2928 wrote to memory of 2256	2928	Windows Explorer.exe	183
PID 2928 wrote to memory of 2256	2928	Windows Explorer.exe	183
PID 2928 wrote to memory of 3640	2928	Windows Explorer.exe	124
PID 2928 wrote to memory of 3640	2928	Windows Explorer.exe	124
PID 2928 wrote to memory of 240	2928	Windows Explorer.exe	125
PID 2928 wrote to memory of 240	2928	Windows Explorer.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2496	attrib.exe

C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
"C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:3588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        Suspicious use of AdjustPrivilegeToken
        
        PID:2708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3168
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "gdb --version"
      4⤵
      PID:1572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        5⤵
        
        PID:3600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3680
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:3084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3684
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:3576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:812
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "schtasks /query /TN "ExelaUpdateService""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /TN "ExelaUpdateService"
        5⤵
        
        PID:4940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:3124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3508
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:1940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3460
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      PID:2256
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:684
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:2704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      PID:3640
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:3780
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:5092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:240
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:2368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
      4⤵
      PID:4224
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
      4⤵
      PID:1004
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:4000
    - - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        5⤵
        
        PID:1824
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        5⤵
        Collects information from the system
        
        PID:3900
    - - C:\Windows\system32\net.exe
        
        net user
        5⤵
        
        PID:3600
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        6⤵
        
        PID:2532
    - - C:\Windows\system32\query.exe
        
        query user
        5⤵
        
        PID:1104
      - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        6⤵
        
        PID:2448
    - - C:\Windows\system32\net.exe
        
        net localgroup
        5⤵
        
        PID:4852
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        6⤵
        
        PID:4200
    - - C:\Windows\system32\net.exe
        
        net localgroup administrators
        5⤵
        
        PID:4304
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        6⤵
        
        PID:3252
    - - C:\Windows\system32\net.exe
        
        net user guest
        5⤵
        
        PID:1096
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        6⤵
        
        PID:4952
    - - C:\Windows\system32\net.exe
        
        net user administrator
        5⤵
        
        PID:2984
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        6⤵
        
        PID:4516
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        5⤵
        
        PID:1908
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        5⤵
        Enumerates processes with tasklist
        
        PID:1992
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        5⤵
        Gathers network information
        
        PID:2408
    - - C:\Windows\system32\ROUTE.EXE
        
        route print
        5⤵
        
        PID:2024
    - - C:\Windows\system32\ARP.EXE
        
        arp -a
        5⤵
        
        PID:1484
    - - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        5⤵
        Gathers network information
        
        PID:1084
    - - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        5⤵
        Launches sc.exe
        
        PID:4248
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        5⤵
        Modifies Windows Firewall
        
        PID:3420
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        5⤵
        Modifies Windows Firewall
        
        PID:1816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      PID:4004
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1740
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:1460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:1936
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:4804
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:784
- C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
  "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
    3⤵
    - Executes dropped EXE
    PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
      "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1140
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1564
- - C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
    "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
    3⤵
    PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
      "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
      4⤵
      Executes dropped EXE
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4772
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
      "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
      4⤵
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        5⤵
        Executes dropped EXE
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        6⤵
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        5⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        6⤵
        Executes dropped EXE
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        7⤵
        Executes dropped EXE
        
        PID:1496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        8⤵
        
        PID:2256
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        6⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        7⤵
        Executes dropped EXE
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        8⤵
        Executes dropped EXE
        
        PID:1500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        9⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        7⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        8⤵
        Executes dropped EXE
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        9⤵
        Executes dropped EXE
        
        PID:1120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        10⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        8⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        9⤵
        Executes dropped EXE
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        10⤵
        Executes dropped EXE
        
        PID:3984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        11⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        9⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        10⤵
        Executes dropped EXE
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        11⤵
        Executes dropped EXE
        
        PID:3364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        12⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        10⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        11⤵
        Executes dropped EXE
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        12⤵
        Executes dropped EXE
        
        PID:2512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        13⤵
        
        PID:2504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        13⤵
        
        PID:3504
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        14⤵
        Detects videocard installed
        
        PID:1748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
        13⤵
        
        PID:2516
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        14⤵
        
        PID:2992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "gdb --version"
        13⤵
        
        PID:1708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        13⤵
        
        PID:3056
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        14⤵
        Enumerates processes with tasklist
        
        PID:3500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
        13⤵
        
        PID:380
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        14⤵
        
        PID:1816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        13⤵
        
        PID:2932
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        14⤵
        
        PID:1424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        13⤵
        
        PID:760
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        14⤵
        Enumerates processes with tasklist
        
        PID:3448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "schtasks /query /TN "ExelaUpdateService""
        13⤵
        
        PID:2428
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /query /TN "ExelaUpdateService"
        14⤵
        
        PID:1492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        13⤵
        
        PID:2936
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        14⤵
        Enumerates processes with tasklist
        
        PID:388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        13⤵
        
        PID:1796
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        14⤵
        
        PID:4952
        
        C:\Windows\system32\chcp.com
        
        chcp
        15⤵
        
        PID:2716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        13⤵
        
        PID:2284
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        14⤵
        
        PID:1076
        
        C:\Windows\system32\chcp.com
        
        chcp
        15⤵
        
        PID:4684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        13⤵
        
        PID:4244
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        14⤵
        Enumerates processes with tasklist
        
        PID:2600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
        13⤵
        
        PID:3084
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        14⤵
        
        PID:1120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        14⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
        13⤵
        
        PID:1140
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        14⤵
        Gathers system information
        
        PID:2484
        
        C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        14⤵
        
        PID:2928
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        14⤵
        Collects information from the system
        
        PID:3304
        
        C:\Windows\system32\net.exe
        
        net user
        14⤵
        
        PID:2780
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        15⤵
        
        PID:228
        
        C:\Windows\system32\query.exe
        
        query user
        14⤵
        
        PID:2956
        
        C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        15⤵
        
        PID:4084
        
        C:\Windows\system32\net.exe
        
        net localgroup
        14⤵
        
        PID:2992
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        15⤵
        
        PID:4248
        
        C:\Windows\system32\net.exe
        
        net localgroup administrators
        14⤵
        
        PID:3488
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        15⤵
        
        PID:4360
        
        C:\Windows\system32\net.exe
        
        net user guest
        14⤵
        
        PID:3528
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        15⤵
        
        PID:3984
        
        C:\Windows\system32\net.exe
        
        net user administrator
        14⤵
        
        PID:2304
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        15⤵
        
        PID:4264
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        14⤵
        
        PID:2264
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        14⤵
        Enumerates processes with tasklist
        
        PID:3172
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        14⤵
        Gathers network information
        
        PID:1892
        
        C:\Windows\system32\ROUTE.EXE
        
        route print
        14⤵
        
        PID:3912
        
        C:\Windows\system32\ARP.EXE
        
        arp -a
        14⤵
        
        PID:4500
        
        C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        14⤵
        Gathers network information
        
        PID:4304
        
        C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        14⤵
        Launches sc.exe
        
        PID:2112
        
        C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        14⤵
        Modifies Windows Firewall
        
        PID:3244
        
        C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        14⤵
        Modifies Windows Firewall
        
        PID:4032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        13⤵
        
        PID:3600
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        14⤵
        
        PID:2016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        13⤵
        
        PID:1116
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        14⤵
        
        PID:3164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        13⤵
        
        PID:3004
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        14⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        11⤵
        
        PID:276
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        12⤵
        Executes dropped EXE
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        13⤵
        Executes dropped EXE
        
        PID:2192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        14⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        12⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        13⤵
        Executes dropped EXE
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        14⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        15⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        13⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        14⤵
        Executes dropped EXE
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        15⤵
        Executes dropped EXE
        
        PID:2324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        16⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        14⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        15⤵
        Executes dropped EXE
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        16⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        17⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        15⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        16⤵
        Executes dropped EXE
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        17⤵
        Executes dropped EXE
        
        PID:2104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        18⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        16⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        17⤵
        Executes dropped EXE
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        18⤵
        Executes dropped EXE
        
        PID:4772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        19⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        17⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        18⤵
        Executes dropped EXE
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        19⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        20⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        18⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        19⤵
        Executes dropped EXE
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        20⤵
        Executes dropped EXE
        
        PID:876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        21⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        19⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        20⤵
        Executes dropped EXE
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        21⤵
        Executes dropped EXE
        
        PID:4224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        22⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        20⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        21⤵
        Executes dropped EXE
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        22⤵
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        23⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        21⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        22⤵
        Executes dropped EXE
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        23⤵
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        24⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        22⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        23⤵
        Executes dropped EXE
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        24⤵
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        25⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        23⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        24⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        25⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        26⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        24⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        25⤵
        Executes dropped EXE
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        26⤵
        Executes dropped EXE
        
        PID:4616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        27⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        25⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        26⤵
        Executes dropped EXE
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        27⤵
        Executes dropped EXE
        
        PID:1364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        28⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        26⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        27⤵
        Executes dropped EXE
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        28⤵
        Executes dropped EXE
        
        PID:1116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        29⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        27⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        28⤵
        Executes dropped EXE
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        29⤵
        Executes dropped EXE
        
        PID:1604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        30⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        28⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        29⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        30⤵
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        31⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        29⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        30⤵
        Executes dropped EXE
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        31⤵
        Executes dropped EXE
        
        PID:936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        32⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        30⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        31⤵
        Executes dropped EXE
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        32⤵
        Executes dropped EXE
        
        PID:1296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        33⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        31⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        32⤵
        Executes dropped EXE
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        33⤵
        Executes dropped EXE
        
        PID:2164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        34⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        32⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        33⤵
        Executes dropped EXE
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        34⤵
        Executes dropped EXE
        
        PID:1168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        35⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        33⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        34⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        35⤵
        
        PID:228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        36⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        34⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        35⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        36⤵
        
        PID:3744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        37⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        35⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        36⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        37⤵
        
        PID:568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        38⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        36⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        37⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        38⤵
        
        PID:4656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        39⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        37⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        38⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        39⤵
        
        PID:4084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        40⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        38⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        39⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        40⤵
        
        PID:3516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        41⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        39⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        40⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        41⤵
        
        PID:4576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        42⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        40⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        41⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        42⤵
        
        PID:4912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        43⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        41⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        42⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        43⤵
        
        PID:3012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        44⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        42⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        43⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        44⤵
        
        PID:4048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        45⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        43⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        44⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        45⤵
        
        PID:3260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        46⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        44⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        45⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        46⤵
        
        PID:2980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        47⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        45⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        46⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        47⤵
        
        PID:1976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        48⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        46⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        47⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        48⤵
        
        PID:3488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        49⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        47⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        48⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        49⤵
        
        PID:4004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        50⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        48⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        49⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe"
        50⤵
        
        PID:3528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        51⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BlackFollow.exe"
        49⤵
        
        PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BlackFollow.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Temp\HistoryData.db

Filesize
116KB

MD5
4e2922249bf476fb3067795f2fa5e794

SHA1
d2db6b2759d9e650ae031eb62247d457ccaa57d2

SHA256
c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

SHA512
8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

Download Submit
C:\Users\Admin\AppData\Local\Temp\HistoryData.db

Filesize
152KB

MD5
73bd1e15afb04648c24593e8ba13e983

SHA1
4dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91

SHA256
aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b

SHA512
6eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Web.db

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Web.db

Filesize
100KB

MD5
8f7c33da3a9fc1fbfeea5db4ec4545c3

SHA1
37a3cdc4732b827aa2314481a75d7cd357a85b11

SHA256
e46d3efa4203b94ff6507efcc2a5fdc0c230c81f00fe12ab94d36eeb0cef773b

SHA512
bfc826f1a0b593620c10654395912297d270b6c8d0f3e61b84125fa59edeb16531f76a347069c25482b5fde00332398c7afc8ecd3afcffce75ec091caac7d823

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows Explorer.exe

Filesize
12.6MB

MD5
416d90082a860d48c4315066a0acfedb

SHA1
5596e599ac839cd3f89fceeec8efc7ba4fb34e87

SHA256
9abbc3b39c02cec08bba97b4fcb7047af7546f141da3ebc5d4cc08e332b82d5d

SHA512
d766010a3e158e52a33f6880466fafb4c67fa13689a2caac776a749af0103de6409cc9f7c790edb73a55c2b744c0a1de35376cf67419285f89ea0f5bee00d858

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14962\attrs-23.2.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17962\attrs-23.2.0.dist-info\METADATA

Filesize
9KB

MD5
e32d387a89f0114b8f9b9a809905299d

SHA1
a055c9fbf5416c83d5150d49ca16c58762b8b84a

SHA256
5b0bc6ece1f22a310fa72154642098b759f413f09ca9d45bedb96218475c9be0

SHA512
6eee3e19af46a79e2110678f8d3d15ea4b2eb1355d0fc9581da2c8e91d28926a2771394ea447e15cbc311a9dd9de2a20e2ac0e0abf9db6d4d51982199a12e881

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17962\attrs-23.2.0.dist-info\RECORD

Filesize
3KB

MD5
0461ab56c7d588c2d9596f91e16658ec

SHA1
013e2923cac817d68ee9ecf9a812e41707c4c7fd

SHA256
a6de30062543c20b137871403f784f12622118583313e9288a9389c005de59af

SHA512
dd217fccdd005ec00c34621edd879a6dac57f11065ddd628d0166fc3f2d78f32e282cca86aeab71d80928d834657a1e1d8d704f2a3bef98410ee2d2e614a9590

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17962\attrs-23.2.0.dist-info\WHEEL

Filesize
87B

MD5
c58f7d318baa542f6bfd220f837ab63f

SHA1
f655fc3c0eb1bf12629c5750b2892bd896c3e7d9

SHA256
99161210bdc887a8396bf095308730885fffd007b8fe02d8874d5814dc22ab59

SHA512
3da6980a39c368ab7f7527fcd5fcdaa9d321060174baae163bf73f8052a2ac1a73f476c3882855965dfc2cb13c7c3ec1a012882201389dac887f9be59540c80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17962\attrs-23.2.0.dist-info\licenses\LICENSE

Filesize
1KB

MD5
5e55731824cf9205cfabeab9a0600887

SHA1
243e9dd038d3d68c67d42c0c4ba80622c2a56246

SHA256
882115c95dfc2af1eeb6714f8ec6d5cbcabf667caff8729f42420da63f714e9f

SHA512
21b242bf6dcbafa16336d77a40e69685d7e64a43cc30e13e484c72a93cd4496a7276e18137dc601b6a8c3c193cb775db89853ecc6d6eb2956deee36826d5ebfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17962\cryptography-42.0.4.dist-info\LICENSE

Filesize
197B

MD5
8c3617db4fb6fae01f1d253ab91511e4

SHA1
e442040c26cd76d1b946822caf29011a51f75d6d

SHA256
3e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb

SHA512
77a1919e380730bcce5b55d76fbffba2f95874254fad955bd2fe1de7fc0e4e25b5fdaab0feffd6f230fa5dc895f593cf8bfedf8fdc113efbd8e22fadab0b8998

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17962\cryptography-42.0.4.dist-info\LICENSE.APACHE

Filesize
11KB

MD5
4e168cce331e5c827d4c2b68a6200e1b

SHA1
de33ead2bee64352544ce0aa9e410c0c44fdf7d9

SHA256
aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe

SHA512
f451048e81a49fbfa11b49de16ff46c52a8e3042d1bcc3a50aaf7712b097bed9ae9aed9149c21476c2a1e12f1583d4810a6d36569e993fe1ad3879942e5b0d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17962\cryptography-42.0.4.dist-info\LICENSE.BSD

Filesize
1KB

MD5
5ae30ba4123bc4f2fa49aa0b0dce887b

SHA1
ea5b412c09f3b29ba1d81a61b878c5c16ffe69d8

SHA256
602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb

SHA512
ddbb20c80adbc8f4118c10d3e116a5cd6536f72077c5916d87258e155be561b89eb45c6341a1e856ec308b49a4cb4dba1408eabd6a781fbe18d6c71c32b72c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17962\cryptography-42.0.4.dist-info\METADATA

Filesize
5KB

MD5
fd7b37afc58c18614de4a63de90c55f1

SHA1
795b019d31767ae69de1b2b2ca089f1e5da95859

SHA256
d64f9e503cdd963961b0d14507dabe80e36e0091912f0576401a54bee736fab7

SHA512
12e35b38990b1c1a6139888ac10c6bf83df49b58fdc6a316f00e7a0a1fb2f9703ac47493fca95d13f9935be0b59a7ed2a74d8d38b7592b9671d697a7cc9c4e14

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17962\cryptography-42.0.4.dist-info\RECORD

Filesize
14KB

MD5
7a9c8fc5d8f6c8588dde14148acd4c81

SHA1
4a463f6860f884982980a8186efb3674c8b93d8c

SHA256
201b48606e6de0d504e90f9a26aedf28300bf0a31ad54fa2885fafa36db94355

SHA512
8c6140e2ae9efdf408359eae1b6694bf31992e61f8626b949228e203e4999e0947fd3a69f695affe88275b243296628f2a7c8d81418b7fc1c593546838ecde9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17962\cryptography-42.0.4.dist-info\WHEEL

Filesize
100B

MD5
c48772ff6f9f408d7160fe9537e150e0

SHA1
79d4978b413f7051c3721164812885381de2fdf5

SHA256
67325f22d7654f051b7a1d92bd644f6ebaa00df5bf7638a48219f07d19aa1484

SHA512
a817107d9f70177ea9ca6a370a2a0cb795346c9025388808402797f33144c1baf7e3de6406ff9e3d8a3486bdfaa630b90b63935925a36302ab19e4c78179674f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17962\cryptography-42.0.4.dist-info\top_level.txt

Filesize
13B

MD5
e7274bd06ff93210298e7117d11ea631

SHA1
7132c9ec1fd99924d658cc672f3afe98afefab8a

SHA256
28d693f929f62b8bb135a11b7ba9987439f7a960cc969e32f8cb567c1ef79c97

SHA512
aa6021c4e60a6382630bebc1e16944f9b312359d645fc61219e9a3f19d876fd600e07dca6932dcd7a1e15bfdeac7dbdceb9fffcd5ca0e5377b82268ed19de225

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17962\cryptography\hazmat\bindings\_rust.pyd

Filesize
2.0MB

MD5
b27c3b72baf5ab17dcc80a113010cab7

SHA1
b36b0e9508ee411405b1f5a0273ea50632a69637

SHA256
48281fc151c0473d7f1e40407f52d3b5222541c75a1ed694fccc9def65fb7f71

SHA512
6fa2f57225710da59502f1361061626d399663ae263f84bc887bb62ba65d0c36a547d3dd10816d400883ebf328bb86269aa7003a2ce9758568e7cec7c9a15343

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_asyncio.pyd

Filesize
36KB

MD5
5f0d1334cf0c88d0a89d59d90d3c8d7f

SHA1
5651b9527da3870d5d38561d3d3d2a12b18b4762

SHA256
65c1ea882322b224b56e94eb488b0eac29e8910752300ca629beb76885f43e87

SHA512
0d3d6fbe13bd7ea89012b5f4b5b95aadf4a97537f2a6e7cb3c574fae5410effe3e3f04ea5147df4a627029e57e4a1ce60d99d9d384eedb0a6230edffce21865e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_bz2.pyd

Filesize
48KB

MD5
49d7eeb9edf72ecc9aa1f3f7751f594c

SHA1
46a3bf76d817533fb2c9dda88cbf75f2dc1cee81

SHA256
28a6b14c9d35e01d75abe386eb6a456b663e09c79ffa113e12d015ac75840b04

SHA512
bbefd1ffb5052dbcc7eec55d6be6aa7604c1b35b0c16aa7448f280cf4aa34ff33207f3586aa548e8823a9aaabb7c4854eb982a7408c238966c46b5e5c7aeba0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_cffi_backend.cp311-win_amd64.pyd

Filesize
71KB

MD5
2443ecaddfe40ee5130539024324e7fc

SHA1
ea74aaf7848de0a078a1510c3430246708631108

SHA256
9a5892ac0cd00c44cd7744d60c9459f302d5984ddb395caea52e4d8fd9bca2da

SHA512
5896af78cf208e1350cf2c31f913aa100098dd1cf4bae77cd2a36ec7695015986ec9913df8d2ebc9992f8f7d48bba102647dc5ee7f776593ae7be36f46bd5c93

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_ctypes.pyd

Filesize
58KB

MD5
7c1116e1656d8ab1192d927e8dd9607e

SHA1
5df70de7ed358a5cf95d3ef16bdd53db74c1e2f0

SHA256
a0ab67ea3f27337ed0873d07901eff16f0e6eb58fa7436bb0bde15a35516acc3

SHA512
004bdff5a4d76ad0d7ca3b000615de904660abccc737b3aadfee5488155e3f55612aed2bc7c1e14db07e7e784f35b779abcfe5217ea972a1bc6dd0bafad04699

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_decimal.pyd

Filesize
106KB

MD5
402beeb25b14b6182335d6fd19fb1e4f

SHA1
2ad5900f0e9aa7e86329da9598cf8315926abb4c

SHA256
66391f61f499833e083ed8ba90f08165224f7ae4a6d719bd3927cc11172736c1

SHA512
54221bad46becfbac2001149f31438b99dc91b2a232fca61f0686f0a51c02bc47d226c9ed2873f7b17dabfc248a46826723297e2c3482e01d79fa7056366d1ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_hashlib.pyd

Filesize
35KB

MD5
1707552b695aa251dc4a205b55eb92df

SHA1
3ef80ee38fdf87236b224e2faf743d5689714b45

SHA256
9e513d47d56fb59ca9794b129153e75231d7d684b61cc6c7612bf4abda85b4b0

SHA512
97b3947a5a446f45e9ca0b7d8cf945ba4eb42f38543ab67aee563aad8040ad332f1b51663e80352ea973998abbf255df6ec4cc38d795f7a02c20a453e852aed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_lzma.pyd

Filesize
86KB

MD5
3a53da080c83b709581e5a117b6e308e

SHA1
efa5bf61d6b8384b8c4050fd6b579b3f13ff2ebf

SHA256
779762b87cdf4bcebaa3a571f25324ea7b9e2c8b85833172acc0b58c6af5508c

SHA512
2be3b2085032ed26b734a70a0a94b420ad4c9130cdda38b7dc4b9677d603b3631d1d013839940ae165be85f65400cb77b31804c8806b91b13d0fe1893a6c7254

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_multiprocessing.pyd

Filesize
26KB

MD5
326061e57a55149d68f3cc931d45ada1

SHA1
9e09ad5ca0551359e77b3cfedad4851f85672ec8

SHA256
dbcce7f1ac98ce01e5e6fea036922ebad3e207e3e97ed07a6445e8f3e3bd66fa

SHA512
3de46fcc8f4e5346a689c3d6cdd7aebc34b8d688b9e60b47e490a117514519c51663ea5f517c96c6b1b07892e533ae3cff40007dc6a8faa50afd71e8a7c09f44

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_overlapped.pyd

Filesize
32KB

MD5
b2b4b47fb5580a9d7c3d975f4d318660

SHA1
da6e2913670c586b4cf729c8f639f305cce6ca74

SHA256
8a210d5bf97189d4bb2d384d262c718eeb8ba549e3bc7a1300275433edcac6ef

SHA512
f3ed282d79e5ae6229e94036439e0030fcf7a592a8227ce8759f1aafda91f1241282653ffd4635eb8acd00eb5ed3c1373d0dd86fb93dc836012d84a1f43f16dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_queue.pyd

Filesize
25KB

MD5
53c0acf7733afe17cc0b2a4f39793724

SHA1
8c6304bad8e2c009fea48eb4c13c77b793b30a33

SHA256
1dda443bd40f46ce6c60ebbbd7a8d38a9c6c696a8620834b4b62ae5d45fd5e7c

SHA512
fdfb9e9d410746faa531c8f4007b4087b35bc1ea0ca00946f96ac5901eefe66bda2296021c004d070246d5a17afe6a65315c0d2ec7658761ef5d78a23b5f8df9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_socket.pyd

Filesize
43KB

MD5
14ab7774579ee7848cb48ab6a6364c6b

SHA1
3da679166989b6d944ba20ea0001929840bc5354

SHA256
d1dd324fdf327b6b4af757ccb0863ef11901d34344bf78480ab0013b6c2b47de

SHA512
d06b939303907851c4491c9564ed091cc06693f2a5eb5d7d098306fb0c7b96bfcc0bf993bf0edbc504e0681e4520d4d491d1c114547e6019e6b6cc1f4d0958d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_sqlite3.pyd

Filesize
56KB

MD5
78aa09523acdd53971d9ee0cc69c901e

SHA1
e15972b2ce482712a6076536a2ee33ac5f0bfcac

SHA256
6e778bac115204796aef74f98a293b7ec10de0801b2f8296d260448870993e5f

SHA512
bbb6928709786dec35580e6e256e446cec2f3468266fc93523c9ada126be3df8e898fcec989a6108f042cf8315f6e00bf78fe12c0dfb3ec3f6e7eae808e206a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_ssl.pyd

Filesize
65KB

MD5
d674ccf80fb5b1e1b09d2437ee572af7

SHA1
76cb6ca0715b27cf0e654ddd5655670df0d16e2a

SHA256
b094a056b5d4f012b6acbf70be5a0fafc0ef7a3ba7173179ac601da475464d7a

SHA512
747a79b06ba5b196dc1f9709ee4980c6955a5047b923ad101df878e84ee17b18ae44c55a0cc5ab378382a6203ee7b9969f41966715a3dbb7aa2e09fe1e273696

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_uuid.pyd

Filesize
24KB

MD5
b21b864e357ccd72f35f2814bd1e6012

SHA1
2ff0740c26137c6a81b96099c1f5209db33ac56a

SHA256
ce9e2a30c20e6b83446d9ba83bb83c5570e1b1da0e87ff467d1b4fc090da6c53

SHA512
29667eb0e070063ef28b7f8cc39225136065340ae358ad0136802770b2f48ac4bda5e60f2e2083f588859b7429b9ea3bad1596a380601e3b2b4bb74791df92a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\aiohttp\_helpers.cp311-win_amd64.pyd

Filesize
26KB

MD5
09b11699cdba4bc48cc6885a87af625a

SHA1
4f2882a14aea02b8fbf880485f19c43ba1f853ad

SHA256
f6fe3a897a1d55e7f5de95f81ea6fcbc791329d6eaef6f33eb4227043b87adc1

SHA512
c74c8caffd7b4c04828a0ff13efffe35feeb28917bed80179b1a4a9e8750c2e2156ce1307fb737efd8b4bf6ce2fda09b301bf33ac216045cf7638681db2d3368

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\aiohttp\_http_parser.cp311-win_amd64.pyd

Filesize
78KB

MD5
f1f62b84c0b35781907bb21592bc4505

SHA1
fe87d2ffad8ce88db37bafcc99d81a217a08ab9f

SHA256
d0dda39645e4c7077ffb31b51a20765406c4d93a2df4d1813ed7ee639d9c002a

SHA512
b901b769802c1d5c9dd2cfa2585386fa1c3d824a335262c9306da2aa01924e52d132c20b913940a1cf9d27251c041b5470aa652b4e6a072a7644d328dc270923

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\aiohttp\_http_writer.cp311-win_amd64.pyd

Filesize
24KB

MD5
4d3a451a342357750063c159cd2757cf

SHA1
eb2d48a21b4a71279d3be521e7b6db2f39e1c435

SHA256
8ec1721df7ad36c7f770e7a7a5b0e4a0016d9cefc349148e8c28220d58619fcf

SHA512
4378adc0546a4ed430ee2cbb14fbb62424c7c135335e0dff8a677991105f5a83ddf4b36c694ae6fe473da20b88182361274e27fd71a5b20ce2f01d4e36963ed3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\aiohttp\_websocket.cp311-win_amd64.pyd

Filesize
19KB

MD5
791d5c587c717986b9f43bcb197b9e18

SHA1
3e460efe0aeab8f776658c3b776fb148650fe5f2

SHA256
5d74710030f51eee0e7b4de7b53ec45b552f01c2016767ea12038d0e23999896

SHA512
785bc62a274e05e315a278b143afc6b597444ba61d420a4a2c2dcd7c46b08ab03aeca42429b6c6e8d548405e1602aeb24312f85878f12ab19cea0985dae28131

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\base_library.zip

Filesize
1.4MB

MD5
6e706e4fa21d90109df6fce1b2595155

SHA1
5328dd26b361d36239facff79baca1bab426de68

SHA256
ce9b9f16ce0d9abdbac3307115d91eaf279c5152336ccbe8830151b41c802998

SHA512
c7e377e2854ad5b5c3fb23593817ad6345bf8a78d842ff2a45c3be135fad6bb27b67c5b6c01b26e7c1b1b12ea0814f4f6b6a522bbfa689b89fa50d3652799b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\frozenlist\_frozenlist.cp311-win_amd64.pyd

Filesize
35KB

MD5
15b0df96344baf6a4c72766721943e52

SHA1
a3666e88594d1ec97de23b9242f346c43a34c070

SHA256
abb6f497003738db2407b01dfa0abc61f6bc7fdb2452c52f76ab11f5430d844f

SHA512
4fbf295d0882646b8c4b3284f11331fb12767fd1404d78d3e4d88a434896058c2df05dd1a2d9c8ce696d2d3aad8c7251d00d95c399df2e8c11bb319f87a4385e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\libcrypto-3.dll

Filesize
1.6MB

MD5
443fd07a22ff1a688a3505d35f3c3dd1

SHA1
ab9f501aa1d3d523b45f8170e53981672cd69131

SHA256
f9c87ec6401039fd03b7c6732c74d1abfdb7c07c8e9803d00effe4c610baa9ee

SHA512
1de390d5d9872c9876662f89c57173391ecd300cabde69c655b2ade7eea56e67376839607cac52572111b88a025797060653dc8bb987c6a165f535b245309844

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\libffi-8.dll

Filesize
29KB

MD5
0d1c6b92d091cef3142e32ac4e0cc12e

SHA1
440dad5af38035cb0984a973e1f266deff2bd7fc

SHA256
11ee9c7fb70c3756c0392843245935517171b95cc5ba0d696b2c1742c8d46fb6

SHA512
5d514ecab93941e83c008f0e9749f99e330949580884bf4850b11cac08fe1ac4ac50033e8888045fe4a9d8b4d2e3ea667b39be18f77266d00f8d7d6797260233

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\libssl-3.dll

Filesize
222KB

MD5
364a71831c9bd0a09eeeceb6980c58c7

SHA1
9d084ccb83e12ddccd17250a009362d720e6271c

SHA256
3b20fb46f41234f8f7bbe342cfebfbbce5708d963cf5c7792d1237a1bc7b2676

SHA512
5abe19130f9306fd6fc3644412ef6c8c5b7da970cfaed69657a6cb62d431abfbba64fefcbfa82910d17d744e299e3ba5036bd490223b2bf28689cf2e70633dce

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\multidict\_multidict.cp311-win_amd64.pyd

Filesize
20KB

MD5
eeaded775eabfaaede5ca025f55fd273

SHA1
8eefb3b9d85b4d5ad4033308f8af2a24e8792e02

SHA256
db4d6a74a3301788d32905b2ccc525e9a8e2219f1a36924464871cf211f115a0

SHA512
a6055d5604cc53428d89b308c223634cd94082be0ba4081513974e1826775d6e9fc26180c816d9a38fead89b5e04c5e7cf729c056bfae0ed74d6885c921b70ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\pyexpat.pyd

Filesize
87KB

MD5
c79cb140401e870e562e451700f8dc42

SHA1
387c7aa25ae47c92968ffccd861ee4b0074b1f37

SHA256
60820b343d07f51d2d056c72475b4efbf1432bc50834faeb7d93a7974da3cdf8

SHA512
85b161fec6bb114efd7c1191b67db254c038ae510ee16fefc3ec7f6572002cdb7aecbc6215fa2e1773fdd9e3f6eca76ad41c9ed3ce4e41db3036f673127834d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\python3.DLL

Filesize
65KB

MD5
35da4143951c5354262a28dee569b7b2

SHA1
b07cb6b28c08c012eecb9fd7d74040163cdf4e0e

SHA256
920350a7c24c46339754e38d0db34ab558e891da0b3a389d5230a0d379bee802

SHA512
2976667732f9ee797b7049d86fd9beeb05409adb7b89e3f5b1c875c72a4076cf65c762632b7230d7f581c052fce65bb91c1614c9e3a52a738051c3bc3d167a23

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\python311.dll

Filesize
1.6MB

MD5
476ab587f630eb4f9c21e88a065828b0

SHA1
d563e0d67658861a5c8d462fcfa675a6840b2758

SHA256
7cf19201904e4e7db4e5e44cd92d223fb94ddd43da04a03d11e388bf41686b8b

SHA512
3d67e49a09777e6fab36c37cf3a7c2768382eb1c850638b0064e2b00479f74251bb70290fe62971944344ee88b7803ee1697a374a62c7f7c45a556c820800676

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\select.pyd

Filesize
25KB

MD5
2b57ad3042174698a12ff119c21488ea

SHA1
33fdbd701caee66fcc1beb979c8e866a77124f03

SHA256
aef792adfaf8e1b6cdfd3a9b721abc8f66b4fdc21778c9fae5d39385ab003e27

SHA512
623332bed6e9ae88a0d313e15f6565ca7ffc71f728ca842cebae80b24c669c82188080b6646ee402fb7b5d26163a4456a170271c1da9992e3c918d4432825999

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\sqlite3.dll

Filesize
630KB

MD5
017a83acbd1f1e17aea2b062bea62fd7

SHA1
ca387752322a61b1884cb52d6a38cdbd4cddcc2f

SHA256
64eec6403b2a8bf8be8554704eff4c6d9e146afbbb655f34a70e0334e3cca3e8

SHA512
96d151290d45f94f0c656d277a7490810711b55f559a0e15efb65d7cba8869b08118f5429a8c8ee7a705bf87fe3f2013e560b950dd3d2b1a40965bacbf9e108b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\unicodedata.pyd

Filesize
295KB

MD5
7fef4897fcaeedd98ee1410a7abd2841

SHA1
7cce279ca32e3ada8344d8cb098e33729a18cd4f

SHA256
4d3bea0a4627d1f43e20ace9b889e52ab93cbcf4562029b0f6db19fd4722077d

SHA512
897f30c9ccfd32776a61a4d6aa80b03f0174ecc4d9368898489a934345bfd32a9c71bee95000cdca9a12e4c85ab0789888928984de6eadeb95252c5468e8fd40

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50162\yarl\_quoting_c.cp311-win_amd64.pyd

Filesize
40KB

MD5
9a8f969ecdf0c15734c1d582d2ae35d8

SHA1
a40691e81982f610a062e49a5ad29cffb5a2f5a8

SHA256
874e52cceae9a3c967bac7b628f4144c32e51fc77f519542fc1bac19045ecde8

SHA512
e0deb59abef7440f30effb1aab6295b5a50c817f685be30b21a3c453e3099b97fd71984e6ca6a6c6e0021abb6e906838566f402b00a11813e67a4e00b119619f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vkroi2hr.ohm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1140-309-0x00007FFD1FF60000-0x00007FFD1FF82000-memory.dmp

Filesize
136KB

Download
memory/1140-281-0x00007FFD22360000-0x00007FFD22379000-memory.dmp

Filesize
100KB

Download
memory/1140-271-0x00007FFD22090000-0x00007FFD220A4000-memory.dmp

Filesize
80KB

Download
memory/1140-308-0x00007FFD1CE70000-0x00007FFD1CF8C000-memory.dmp

Filesize
1.1MB

Download
memory/1140-294-0x00007FFD1FF40000-0x00007FFD1FF57000-memory.dmp

Filesize
92KB

Download
memory/1140-313-0x00007FFD1FF20000-0x00007FFD1FF39000-memory.dmp

Filesize
100KB

Download
memory/1140-261-0x00007FFD202E0000-0x00007FFD20809000-memory.dmp

Filesize
5.2MB

Download
memory/1140-315-0x00007FFD1FED0000-0x00007FFD1FF1A000-memory.dmp

Filesize
296KB

Download
memory/1140-321-0x00007FFD17F80000-0x00007FFD18672000-memory.dmp

Filesize
6.9MB

Download
memory/1140-293-0x00007FFD201F0000-0x00007FFD20204000-memory.dmp

Filesize
80KB

Download
memory/1140-290-0x00007FFD35CE0000-0x00007FFD35CED000-memory.dmp

Filesize
52KB

Download
memory/1140-291-0x00007FFD220B0000-0x00007FFD220C2000-memory.dmp

Filesize
72KB

Download
memory/1140-288-0x00007FFD220D0000-0x00007FFD220E5000-memory.dmp

Filesize
84KB

Download
memory/1140-289-0x00007FFD223C0000-0x00007FFD223D9000-memory.dmp

Filesize
100KB

Download
memory/1140-284-0x00007FFD221E0000-0x00007FFD22203000-memory.dmp

Filesize
140KB

Download
memory/1140-306-0x00007FFD22090000-0x00007FFD220A4000-memory.dmp

Filesize
80KB

Download
memory/1140-303-0x00007FFD20210000-0x00007FFD202DD000-memory.dmp

Filesize
820KB

Download
memory/1140-251-0x00007FFD1E430000-0x00007FFD1EA20000-memory.dmp

Filesize
5.9MB

Download
memory/1140-252-0x00007FFD24840000-0x00007FFD24864000-memory.dmp

Filesize
144KB

Download
memory/1140-253-0x00007FFD360C0000-0x00007FFD360CF000-memory.dmp

Filesize
60KB

Download
memory/1140-255-0x00007FFD35CE0000-0x00007FFD35CED000-memory.dmp

Filesize
52KB

Download
memory/1140-254-0x00007FFD223C0000-0x00007FFD223D9000-memory.dmp

Filesize
100KB

Download
memory/1140-302-0x00007FFD202E0000-0x00007FFD20809000-memory.dmp

Filesize
5.2MB

Download
memory/1140-299-0x00007FFD20810000-0x00007FFD20986000-memory.dmp

Filesize
1.5MB

Download
memory/1140-257-0x00007FFD20810000-0x00007FFD20986000-memory.dmp

Filesize
1.5MB

Download
memory/1140-287-0x00007FFD360C0000-0x00007FFD360CF000-memory.dmp

Filesize
60KB

Download
memory/1140-296-0x00007FFD1EAC0000-0x00007FFD1EAD1000-memory.dmp

Filesize
68KB

Download
memory/1140-285-0x00007FFD24840000-0x00007FFD24864000-memory.dmp

Filesize
144KB

Download
memory/1140-273-0x00007FFD1CE70000-0x00007FFD1CF8C000-memory.dmp

Filesize
1.1MB

Download
memory/1140-274-0x00007FFD1FF60000-0x00007FFD1FF82000-memory.dmp

Filesize
136KB

Download
memory/1140-277-0x00007FFD1FED0000-0x00007FFD1FF1A000-memory.dmp

Filesize
296KB

Download
memory/1140-292-0x00007FFD22360000-0x00007FFD22379000-memory.dmp

Filesize
100KB

Download
memory/1140-275-0x00007FFD1FF20000-0x00007FFD1FF39000-memory.dmp

Filesize
100KB

Download
memory/1140-279-0x00007FFD17F80000-0x00007FFD18672000-memory.dmp

Filesize
6.9MB

Download
memory/1140-270-0x00007FFD20210000-0x00007FFD202DD000-memory.dmp

Filesize
820KB

Download
memory/1140-283-0x00007FFD22210000-0x00007FFD2223D000-memory.dmp

Filesize
180KB

Download
memory/1140-286-0x00007FFD220F0000-0x00007FFD22123000-memory.dmp

Filesize
204KB

Download
memory/1140-282-0x00007FFD1E430000-0x00007FFD1EA20000-memory.dmp

Filesize
5.9MB

Download
memory/2180-250-0x00007FFD23C90000-0x00007FFD24752000-memory.dmp

Filesize
10.8MB

Download
memory/2180-167-0x00000000020A0000-0x00000000020B0000-memory.dmp

Filesize
64KB

Download
memory/2180-64-0x00007FFD23C90000-0x00007FFD24752000-memory.dmp

Filesize
10.8MB

Download
memory/2192-1-0x0000000000D10000-0x0000000001904000-memory.dmp

Filesize
12.0MB

Download
memory/2192-2-0x0000000002270000-0x0000000002280000-memory.dmp

Filesize
64KB

Download
memory/2192-71-0x00007FFD23C90000-0x00007FFD24752000-memory.dmp

Filesize
10.8MB

Download
memory/2192-0-0x00007FFD23C90000-0x00007FFD24752000-memory.dmp

Filesize
10.8MB

Download
memory/2928-152-0x00007FFD34440000-0x00007FFD34457000-memory.dmp

Filesize
92KB

Download
memory/2928-113-0x00007FFD35700000-0x00007FFD35723000-memory.dmp

Filesize
140KB

Download
memory/2928-151-0x00007FFD34E60000-0x00007FFD34E74000-memory.dmp

Filesize
80KB

Download
memory/2928-149-0x00007FFD36000000-0x00007FFD36019000-memory.dmp

Filesize
100KB

Download
memory/2928-150-0x00007FFD35F90000-0x00007FFD35FA5000-memory.dmp

Filesize
84KB

Download
memory/2928-147-0x00007FFD20990000-0x00007FFD21082000-memory.dmp

Filesize
6.9MB

Download
memory/2928-280-0x00007FFD1F8D0000-0x00007FFD1FEC0000-memory.dmp

Filesize
5.9MB

Download
memory/2928-246-0x00007FFD38C90000-0x00007FFD38C9D000-memory.dmp

Filesize
52KB

Download
memory/2928-144-0x00007FFD2B1C0000-0x00007FFD2B1D1000-memory.dmp

Filesize
68KB

Download
memory/2928-103-0x00007FFD360D0000-0x00007FFD360E9000-memory.dmp

Filesize
100KB

Download
memory/2928-114-0x00007FFD35580000-0x00007FFD356F6000-memory.dmp

Filesize
1.5MB

Download
memory/2928-119-0x00007FFD35540000-0x00007FFD35573000-memory.dmp

Filesize
204KB

Download
memory/2928-134-0x000002211C340000-0x000002211C869000-memory.dmp

Filesize
5.2MB

Download
memory/2928-139-0x00007FFD34EE0000-0x00007FFD34EF4000-memory.dmp

Filesize
80KB

Download
memory/2928-142-0x00007FFD306A0000-0x00007FFD306B9000-memory.dmp

Filesize
100KB

Download
memory/2928-154-0x00007FFD29700000-0x00007FFD29738000-memory.dmp

Filesize
224KB

Download
memory/2928-153-0x00007FFD2A0D0000-0x00007FFD2A0EE000-memory.dmp

Filesize
120KB

Download
memory/2928-148-0x00007FFD3B1C0000-0x00007FFD3B1CD000-memory.dmp

Filesize
52KB

Download
memory/2928-70-0x00007FFD1F8D0000-0x00007FFD1FEC0000-memory.dmp

Filesize
5.9MB

Download
memory/2928-143-0x00007FFD2B1E0000-0x00007FFD2B22A000-memory.dmp

Filesize
296KB

Download
memory/2928-90-0x00007FFD38CA0000-0x00007FFD38CC4000-memory.dmp

Filesize
144KB

Download
memory/2928-100-0x00007FFD3B1D0000-0x00007FFD3B1DF000-memory.dmp

Filesize
60KB

Download
memory/2928-112-0x00007FFD35730000-0x00007FFD3575D000-memory.dmp

Filesize
180KB

Download
memory/2928-141-0x00007FFD306C0000-0x00007FFD306E2000-memory.dmp

Filesize
136KB

Download
memory/2928-124-0x00007FFD35470000-0x00007FFD3553D000-memory.dmp

Filesize
820KB

Download
memory/2928-127-0x00007FFD21090000-0x00007FFD215B9000-memory.dmp

Filesize
5.2MB

Download
memory/2928-138-0x00007FFD352B0000-0x00007FFD352C2000-memory.dmp

Filesize
72KB

Download
memory/2928-140-0x00007FFD34D40000-0x00007FFD34E5C000-memory.dmp

Filesize
1.1MB

Download
memory/3232-241-0x00007FFD23C90000-0x00007FFD24752000-memory.dmp

Filesize
10.8MB

Download
memory/3272-260-0x0000015C74D20000-0x0000015C74D42000-memory.dmp

Filesize
136KB

Download
memory/3272-278-0x0000015C74D70000-0x0000015C74D80000-memory.dmp

Filesize
64KB

Download
memory/3272-256-0x00007FFD23C90000-0x00007FFD24752000-memory.dmp

Filesize
10.8MB

Download
memory/3272-258-0x0000015C74D70000-0x0000015C74D80000-memory.dmp

Filesize
64KB

Download
memory/3272-259-0x0000015C74D70000-0x0000015C74D80000-memory.dmp

Filesize
64KB

Download
memory/3576-544-0x00007FFD1F3A0000-0x00007FFD1F8C9000-memory.dmp

Filesize
5.2MB

Download
memory/3576-547-0x00007FFD2A0B0000-0x00007FFD2A0C2000-memory.dmp

Filesize
72KB

Download
memory/3576-546-0x00007FFD35320000-0x00007FFD35335000-memory.dmp

Filesize
84KB

Download
memory/3576-545-0x00007FFD21EC0000-0x00007FFD21F8D000-memory.dmp

Filesize
820KB

Download
memory/3576-541-0x00007FFD35380000-0x00007FFD353A3000-memory.dmp

Filesize
140KB

Download
memory/3576-539-0x00007FFD353E0000-0x00007FFD353F9000-memory.dmp

Filesize
100KB

Download
memory/3576-540-0x00007FFD353B0000-0x00007FFD353DD000-memory.dmp

Filesize
180KB

Download
memory/3576-543-0x00007FFD35340000-0x00007FFD35373000-memory.dmp

Filesize
204KB

Download
memory/3576-542-0x00007FFD21F90000-0x00007FFD22106000-memory.dmp

Filesize
1.5MB

Download
memory/3576-534-0x00007FFD203A0000-0x00007FFD20990000-memory.dmp

Filesize
5.9MB

Download
memory/3576-535-0x00007FFD35420000-0x00007FFD35444000-memory.dmp

Filesize
144KB

Download
memory/3576-537-0x00007FFD35400000-0x00007FFD35419000-memory.dmp

Filesize
100KB

Download
memory/3576-536-0x00007FFD360C0000-0x00007FFD360CF000-memory.dmp

Filesize
60KB

Download
memory/3576-538-0x00007FFD35CE0000-0x00007FFD35CED000-memory.dmp

Filesize
52KB

Download
memory/4772-424-0x00007FFD223A0000-0x00007FFD223B9000-memory.dmp

Filesize
100KB

Download
memory/4772-419-0x00007FFD203A0000-0x00007FFD20990000-memory.dmp

Filesize
5.9MB

Download
memory/4772-437-0x00007FFD21EF0000-0x00007FFD21F07000-memory.dmp

Filesize
92KB

Download
memory/4772-439-0x00007FFD21E80000-0x00007FFD21ECA000-memory.dmp

Filesize
296KB

Download
memory/4772-440-0x00007FFD218C0000-0x00007FFD218D1000-memory.dmp

Filesize
68KB

Download
memory/4772-441-0x00007FFD218A0000-0x00007FFD218BE000-memory.dmp

Filesize
120KB

Download
memory/4772-444-0x00007FFD217A0000-0x00007FFD217D8000-memory.dmp

Filesize
224KB

Download
memory/4772-442-0x00007FFD1ECA0000-0x00007FFD1F392000-memory.dmp

Filesize
6.9MB

Download
memory/4772-422-0x00007FFD223C0000-0x00007FFD223D9000-memory.dmp

Filesize
100KB

Download
memory/4772-438-0x00007FFD21ED0000-0x00007FFD21EE9000-memory.dmp

Filesize
100KB

Download
memory/4772-436-0x00007FFD21F10000-0x00007FFD21F32000-memory.dmp

Filesize
136KB

Download
memory/4772-434-0x00007FFD21F40000-0x00007FFD21F54000-memory.dmp

Filesize
80KB

Download
memory/4772-433-0x00007FFD21F60000-0x00007FFD21F74000-memory.dmp

Filesize
80KB

Download
memory/4772-435-0x00007FFD218E0000-0x00007FFD219FC000-memory.dmp

Filesize
1.1MB

Download
memory/4772-421-0x00007FFD360C0000-0x00007FFD360CF000-memory.dmp

Filesize
60KB

Download
memory/4772-423-0x00007FFD35CE0000-0x00007FFD35CED000-memory.dmp

Filesize
52KB

Download
memory/4772-429-0x00007FFD21FA0000-0x00007FFD2206D000-memory.dmp

Filesize
820KB

Download
memory/4772-431-0x00007FFD22350000-0x00007FFD22365000-memory.dmp

Filesize
84KB

Download
memory/4772-432-0x00007FFD21F80000-0x00007FFD21F92000-memory.dmp

Filesize
72KB

Download
memory/4772-430-0x00007FFD1F3A0000-0x00007FFD1F8C9000-memory.dmp

Filesize
5.2MB

Download
memory/4772-425-0x00007FFD22370000-0x00007FFD2239D000-memory.dmp

Filesize
180KB

Download
memory/4772-428-0x00007FFD22070000-0x00007FFD220A3000-memory.dmp

Filesize
204KB

Download
memory/4772-426-0x00007FFD22230000-0x00007FFD22253000-memory.dmp

Filesize
140KB

Download
memory/4772-427-0x00007FFD220B0000-0x00007FFD22226000-memory.dmp

Filesize
1.5MB

Download
memory/4772-420-0x00007FFD24840000-0x00007FFD24864000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads