Malware Analysis Report

2025-03-15 00:54

Sample ID 240626-1wy4msygmj
Target arceus-x.exe
SHA256 397a157aebc8ad3e0f35719cc7fec0c7f551831f2ebc4e33a0637cbba34639b3
Tags
defense_evasion execution persistence privilege_escalation spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

397a157aebc8ad3e0f35719cc7fec0c7f551831f2ebc4e33a0637cbba34639b3

Threat Level: Shows suspicious behavior

The file arceus-x.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

defense_evasion execution persistence privilege_escalation spyware stealer

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Drops startup file

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Looks up external IP address via web service

Hide Artifacts: Hidden Files and Directories

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Unsigned PE

Event Triggered Execution: Netsh Helper DLL

Suspicious behavior: EnumeratesProcesses

Runs net.exe

Detects videocard installed

Checks processor information in registry

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Views/modifies file attributes

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-26 22:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-26 22:00

Reported

2024-06-26 22:16

Platform

win10v2004-20240611-en

Max time kernel

61s

Max time network

67s

Command Line

"C:\Users\Admin\AppData\Local\Temp\arthe.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDriverSetuprAfumE = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\arthe.exe" C:\Windows\system32\reg.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Runs net.exe

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3540 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 3540 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 4324 wrote to memory of 3748 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4324 wrote to memory of 3748 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 3540 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 3540 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 3540 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 3540 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 3540 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 3540 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 3816 wrote to memory of 1508 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3816 wrote to memory of 1508 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3816 wrote to memory of 536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com
PID 3816 wrote to memory of 536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com
PID 748 wrote to memory of 3124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 748 wrote to memory of 3124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 1872 wrote to memory of 348 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1872 wrote to memory of 348 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3124 wrote to memory of 4620 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 3124 wrote to memory of 4620 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 3540 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 3540 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 3780 wrote to memory of 2280 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3780 wrote to memory of 2280 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3780 wrote to memory of 1748 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com
PID 3780 wrote to memory of 1748 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com
PID 3540 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 3540 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 3284 wrote to memory of 4220 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3284 wrote to memory of 4220 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3284 wrote to memory of 1472 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com
PID 3284 wrote to memory of 1472 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\arthe.exe

"C:\Users\Admin\AppData\Local\Temp\arthe.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=3540 get ExecutablePath"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where processid=3540 get ExecutablePath

C:\Users\Admin\AppData\Local\Temp\arthe.exe

"C:\Users\Admin\AppData\Local\Temp\arthe.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\philhorse" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1972 --field-trial-handle=1976,i,16420787186845195180,13458348089597761291,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Temp\arthe.exe

"C:\Users\Admin\AppData\Local\Temp\arthe.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\philhorse" --mojo-platform-channel-handle=2176 --field-trial-handle=1976,i,16420787186845195180,13458348089597761291,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "net session"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"

C:\Windows\System32\Wbem\WMIC.exe

wmic OS get caption, osarchitecture

C:\Windows\system32\more.com

more +1

C:\Windows\system32\net.exe

net session

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 session

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"

C:\Windows\System32\Wbem\WMIC.exe

wmic cpu get name

C:\Windows\system32\more.com

more +1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"

C:\Windows\System32\Wbem\WMIC.exe

wmic PATH Win32_VideoController get name

C:\Windows\system32\more.com

more +1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=3540 get ExecutablePath"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where processid=3540 get ExecutablePath

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 110.0 (x64 en-US)""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 110.0 (x64 en-US)"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2BB73336-4F69-4141-9797-E9BD6FE3980A}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2BB73336-4F69-4141-9797-E9BD6FE3980A}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{71024AE4-039E-4CA4-87B4-2F64180401F0}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{71024AE4-039E-4CA4-87B4-2F64180401F0}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D46F1FD9-2FE8-4D05-B2AC-011C23B69B24}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D46F1FD9-2FE8-4D05-B2AC-011C23B69B24}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\crLZsPrqAO0O_tezmp.ps1""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\crLZsPrqAO0O_tezmp.ps1"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "mullvad account get"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell -command "function Get-AntiVirusProduct { [CmdletBinding()] param ( [parameter(ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] [Alias('name')] $computername=$env:computername ) $AntiVirusProducts = Get-WmiObject -Namespace "root\\SecurityCenter2" -Class AntiVirusProduct -ComputerName $computername $ret = @() foreach ($AntiVirusProduct in $AntiVirusProducts) { switch ($AntiVirusProduct.productState) { "262144" { $defstatus = "Up to date"; $rtstatus = "Disabled" } "262160" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "266240" { $defstatus = "Up to date"; $rtstatus = "Enabled" } "266256" { $defstatus = "Out of date"; $rtstatus = "Enabled" } "393216" { $defstatus = "Up to date"; $rtstatus = "Disabled" } "393232" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "393488" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "397312" { $defstatus = "Up to date"; $rtstatus = "Enabled" } "397328" { $defstatus = "Out of date"; $rtstatus = "Enabled" } "397584" { $defstatus = "Out of date"; $rtstatus = "Enabled" } default { $defstatus = "Unknown"; $rtstatus = "Unknown" } } $ht = @{} $ht.Computername = $computername $ht.Name = $AntiVirusProduct.displayName $ht.'Product GUID' = $AntiVirusProduct.instanceGuid $ht.'Product Executable' = $AntiVirusProduct.pathToSignedProductExe $ht.'Reporting Exe' = $AntiVirusProduct.pathToSignedReportingExe $ht.'Definition Status' = $defstatus $ht.'Real-time Protection Status' = $rtstatus # Créez un nouvel objet pour chaque ordinateur $ret += New-Object -TypeName PSObject -Property $ht } Return $ret } Get-AntiVirusProduct ""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -command "function Get-AntiVirusProduct {

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetuprAfumE /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe /f"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetuprAfumE /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\" /F /rl highest"

C:\Windows\system32\cmd.exe

cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetuprAfumE /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\" /F /rl highest

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetuprAfumE /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe /f

C:\Windows\system32\schtasks.exe

schtasks /create /sc onlogon /tn WindowsDriverSetuprAfumE /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\" /F /rl highest

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\"""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\""

C:\Windows\system32\attrib.exe

"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell -command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\arthe.exe' $Trigger = New-ScheduledTaskTrigger -Daily -At '12:00PM' Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName StartCacaTask ""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -command "

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 nova-screen-webview.com udp
US 104.21.59.75:443 nova-screen-webview.com tcp
US 104.21.59.75:443 nova-screen-webview.com tcp
US 104.21.59.75:443 nova-screen-webview.com tcp
US 104.21.59.75:443 nova-screen-webview.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:80 www.google.com tcp
US 104.21.59.75:443 nova-screen-webview.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 75.59.21.104.in-addr.arpa udp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 192.186.117.34.in-addr.arpa udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:53 nova-sentinel.com udp
IT 185.196.9.89:443 nova-sentinel.com tcp
US 8.8.8.8:53 api.gofile.io udp
FR 151.80.29.83:443 api.gofile.io tcp
US 8.8.8.8:53 store1.gofile.io udp
US 8.8.8.8:53 89.9.196.185.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 83.29.80.151.in-addr.arpa udp
FR 45.112.123.227:443 store1.gofile.io tcp
US 8.8.8.8:53 ieatpoop.info udp
US 8.8.8.8:53 227.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
IT 185.196.9.97:443 ieatpoop.info tcp
IT 185.196.9.97:443 ieatpoop.info tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
IT 185.196.9.97:443 ieatpoop.info tcp
IT 185.196.9.97:443 ieatpoop.info tcp
IT 185.196.9.97:443 ieatpoop.info tcp
IT 185.196.9.97:443 ieatpoop.info tcp
GB 20.26.156.215:443 github.com tcp
IT 185.196.9.89:443 nova-sentinel.com tcp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 97.9.196.185.in-addr.arpa udp
FR 151.80.29.83:443 api.gofile.io tcp
US 8.8.8.8:53 store10.gofile.io udp
FR 31.14.70.252:443 store10.gofile.io tcp
IT 185.196.9.97:443 ieatpoop.info tcp
US 8.8.8.8:53 252.70.14.31.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\962d85b2-7b4c-4843-b60e-1a263e457bbc.tmp.node

MD5 d6c776d3e3d45398909b8089339cffed
SHA1 1273ed2ed41e60d5829acb44bdf3b944be9ba4c5
SHA256 edce4206cca72b8358ba58e757cd312d2b9226845bc6f19f8f1ea9692a4dae93
SHA512 34124efe5f1ba8b7f49cff1105d4e3e3c71354e1099952a7300fb84c62b178ebd32545ca4f03fa8f7c903f1f6ae18980c6146cba25bc2e92674a9c42bcd93965

C:\Users\Admin\AppData\Local\Temp\96b6a58f-f71d-4004-b723-e12e8bad47fa.tmp.node

MD5 56192831a7f808874207ba593f464415
SHA1 e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA256 6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512 c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

C:\Users\Admin\AppData\Local\Temp\dd85e0bb-3176-48d7-aec2-8b88275e8be9.tmp.node

MD5 6dc80629358026270df0694074b8a18f
SHA1 49e0e9ec3c1aace0cb84b9f1f0fffa060ab31036
SHA256 9a19f419905559e6ca56e81937e273984b2f110103890ca761043cae71133a9e
SHA512 4804a5423a720b2e8ceab41c48cdddfa529d8cfff100de5a2810f20a016f33ffdd6732f39349428cd62fcf067ea0957bbecddc11b8462bad06c0f92055654a22

memory/1548-26-0x0000020F594E0000-0x0000020F59502000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_33fjroc1.kfo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

C:\Users\Admin\AppData\Local\Temp\crLZsPrqAO0O_tezmp.ps1

MD5 9ca2397248158659136fef01c5a637dc
SHA1 460011b47ee64faa06807d7aea191bcafb8b340c
SHA256 bdeb565cf7b528e7b533dda9d236e3572ea25ada06299a51b20aa1f9796ec46f
SHA512 9e80d39ad6c526853c0be9deeea118546b6c4af8fdded54925585e41573ce1ac34d2652a0100d217c2e41e2026dfa0d4b94cff4f31f02a529569a143f1905206

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 8d460ce715a00afd56cda62e926b8b17
SHA1 3aa1ed2a3cd5e6e1a3240f222492c9e49c4eaf22
SHA256 195c9d4857b9486e312f80264b31ef7e9ba014ececd7731397ee75ce8d8f38cb
SHA512 1b9efe45bea12e59e552dcce73d597ad431aa274621d96e5a3d146e28cfb11d9f5af256f0bc986e8d4d043f6352b9410d01ddb048bd57445f544502eaf28d969

C:\Users\Admin\AppData\Local\Temp\ySzlbVldEsxoUHxmIFLo\System\EJEFCDNK - 2024-06-26_221533.png

MD5 0084355bdd2f6ba36ac9f97f996a3248
SHA1 acbeb7875080e79f60b15ee31f562c01b8ec95ff
SHA256 9bd88552e597dfaf6be67d3d9058b7c76559de10d9c016afad7c005f2ef3e4ef
SHA512 787309c1ce798c20d9c3c82947898804e04dc451af1c13ce8f118a8cadb5f194413215608358f13fb295010f062d3d58ae69a3b1eb8b873a5a87f103dff6e331

memory/2604-175-0x00000218A6B80000-0x00000218A6B9E000-memory.dmp

memory/1880-178-0x000001B2E2980000-0x000001B2E299E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

C:\Users\Admin\AppData\Local\Temp\GB_NOVA_Admin_191.zip

MD5 06b060ca310dca88cc9ed5591304daa8
SHA1 a6a1f2f92fb1c5be275460afaa580f5bd3717c57
SHA256 a5319a502b249214cef4cee0dbc44621eb80a828fccef0a13d99ad75f397fdab
SHA512 7638210edeca0f14b4a29c7c1248fc1a85e04c047d755ed2390ed0e0c6d606d8e44aa1358892c34bb112e01ab79b91fdebefad769edaec0e3d1c527077ed144b

C:\Users\Admin\AppData\Local\Temp\ySzlbVldEsxoUHxmIFLo\Browsers\Chrome [ Default ] - Cookies.txt

MD5 ac6b6f59ddc7026c649a1bfaaa39a14c
SHA1 5f6ca81e044bc02d62795cfd2c8594bcb5f49826
SHA256 298d9621236f28ac95c118d2cc5d65535535b3d116f4fb8a3efb21369ce51f10
SHA512 8a92f1433e03dc4e07f03f290aef25dc45e777a7d5826835f3ff9b9d2fcc80cb074582ad373a6f4118d86dbc735f5b423998bdf723ee6633d32e12a122c17df2

C:\Users\Admin\AppData\Local\Temp\ySzlbVldEsxoUHxmIFLo\Browsers\Bookmarks.txt

MD5 b26501fe967cb723a913312c45c750ad
SHA1 5295ea2f9d28dc2ca33f974dbdcf082c1f78f2c7
SHA256 8ce5bf5b36a9bc1e16091332385279bbd51f7b003b479be5bb21285cdceea411
SHA512 f325c52780263ba23f7baeb7169324031d9d52333946867cd98b8950a11e736b131b913b77f025a10b8c9cae9d1fca18f3dd9c34d3f16ce8e12a42e67f3e1d6e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 052b68d98977d4f52cc6afabfa743b06
SHA1 63b671a71cc5ec6b76218b0094784a5e21e08e7f
SHA256 199ac916bb90b9b2107eb749d5c65411c387c7d59f0a2d19d17674983287116a
SHA512 e20517e1d3b755c17c617f9cbab3de19a4b29fc16a3422bbde30530130c2865173b85ee24e336b20c4706740250bc062f789d0c6989d4ed15c6f8527033693af

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-26 22:00

Reported

2024-06-26 22:16

Platform

win11-20240611-en

Max time kernel

61s

Max time network

59s

Command Line

"C:\Users\Admin\AppData\Local\Temp\arthe.exe"

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDriverSetupLvPZUU = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\arthe.exe" C:\Windows\system32\reg.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Runs net.exe

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 864 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 864 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 348 wrote to memory of 240 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 348 wrote to memory of 240 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Users\Admin\AppData\Local\Temp\arthe.exe
PID 864 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 864 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 864 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 864 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 864 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 864 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 1780 wrote to memory of 1684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 1780 wrote to memory of 1684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 2224 wrote to memory of 4264 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2224 wrote to memory of 4264 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3360 wrote to memory of 1660 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3360 wrote to memory of 1660 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2224 wrote to memory of 3424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com
PID 2224 wrote to memory of 3424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com
PID 1684 wrote to memory of 3440 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1684 wrote to memory of 3440 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 864 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 864 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 2604 wrote to memory of 4232 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2604 wrote to memory of 4232 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2604 wrote to memory of 1504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com
PID 2604 wrote to memory of 1504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com
PID 864 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 864 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\arthe.exe C:\Windows\system32\cmd.exe
PID 896 wrote to memory of 5056 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 896 wrote to memory of 5056 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 896 wrote to memory of 2128 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com
PID 896 wrote to memory of 2128 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\arthe.exe

"C:\Users\Admin\AppData\Local\Temp\arthe.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=864 get ExecutablePath"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where processid=864 get ExecutablePath

C:\Users\Admin\AppData\Local\Temp\arthe.exe

"C:\Users\Admin\AppData\Local\Temp\arthe.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\philhorse" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1896 --field-trial-handle=1900,i,2461506406204417994,15462345428441062138,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Temp\arthe.exe

"C:\Users\Admin\AppData\Local\Temp\arthe.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\philhorse" --mojo-platform-channel-handle=2436 --field-trial-handle=1900,i,2461506406204417994,15462345428441062138,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "net session"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"

C:\Windows\system32\net.exe

net session

C:\Windows\System32\Wbem\WMIC.exe

wmic OS get caption, osarchitecture

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 session

C:\Windows\system32\more.com

more +1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"

C:\Windows\System32\Wbem\WMIC.exe

wmic cpu get name

C:\Windows\system32\more.com

more +1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"

C:\Windows\System32\Wbem\WMIC.exe

wmic PATH Win32_VideoController get name

C:\Windows\system32\more.com

more +1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=864 get ExecutablePath"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where processid=864 get ExecutablePath

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 110.0 (x64 en-US)""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 110.0 (x64 en-US)"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2BB73336-4F69-4141-9797-E9BD6FE3980A}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2BB73336-4F69-4141-9797-E9BD6FE3980A}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{71024AE4-039E-4CA4-87B4-2F64180401F0}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{71024AE4-039E-4CA4-87B4-2F64180401F0}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D46F1FD9-2FE8-4D05-B2AC-011C23B69B24}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D46F1FD9-2FE8-4D05-B2AC-011C23B69B24}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\CMj9BY1V4uRa_tezmp.ps1""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\CMj9BY1V4uRa_tezmp.ps1"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "mullvad account get"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell -command "function Get-AntiVirusProduct { [CmdletBinding()] param ( [parameter(ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] [Alias('name')] $computername=$env:computername ) $AntiVirusProducts = Get-WmiObject -Namespace "root\\SecurityCenter2" -Class AntiVirusProduct -ComputerName $computername $ret = @() foreach ($AntiVirusProduct in $AntiVirusProducts) { switch ($AntiVirusProduct.productState) { "262144" { $defstatus = "Up to date"; $rtstatus = "Disabled" } "262160" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "266240" { $defstatus = "Up to date"; $rtstatus = "Enabled" } "266256" { $defstatus = "Out of date"; $rtstatus = "Enabled" } "393216" { $defstatus = "Up to date"; $rtstatus = "Disabled" } "393232" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "393488" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "397312" { $defstatus = "Up to date"; $rtstatus = "Enabled" } "397328" { $defstatus = "Out of date"; $rtstatus = "Enabled" } "397584" { $defstatus = "Out of date"; $rtstatus = "Enabled" } default { $defstatus = "Unknown"; $rtstatus = "Unknown" } } $ht = @{} $ht.Computername = $computername $ht.Name = $AntiVirusProduct.displayName $ht.'Product GUID' = $AntiVirusProduct.instanceGuid $ht.'Product Executable' = $AntiVirusProduct.pathToSignedProductExe $ht.'Reporting Exe' = $AntiVirusProduct.pathToSignedReportingExe $ht.'Definition Status' = $defstatus $ht.'Real-time Protection Status' = $rtstatus # Créez un nouvel objet pour chaque ordinateur $ret += New-Object -TypeName PSObject -Property $ht } Return $ret } Get-AntiVirusProduct ""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -command "function Get-AntiVirusProduct {

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupLvPZUU /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe /f"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupLvPZUU /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\" /F /rl highest"

C:\Windows\system32\cmd.exe

cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupLvPZUU /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\" /F /rl highest

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupLvPZUU /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe /f

C:\Windows\system32\schtasks.exe

schtasks /create /sc onlogon /tn WindowsDriverSetupLvPZUU /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\" /F /rl highest

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\"""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\""

C:\Windows\system32\attrib.exe

"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell -command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\arthe.exe' $Trigger = New-ScheduledTaskTrigger -Daily -At '12:00PM' Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName StartCacaTask ""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -command "

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

Network

Country Destination Domain Proto
US 8.8.8.8:53 nova-screen-webview.com udp
US 172.67.218.107:443 nova-screen-webview.com tcp
US 172.67.218.107:443 nova-screen-webview.com tcp
US 172.67.218.107:443 nova-screen-webview.com tcp
US 172.67.218.107:443 nova-screen-webview.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 172.67.218.107:443 nova-screen-webview.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
IT 185.196.9.89:443 nova-sentinel.com tcp
FR 51.178.66.33:443 api.gofile.io tcp
FR 45.112.123.227:443 store1.gofile.io tcp
IT 185.196.9.97:443 ieatpoop.info tcp
IT 185.196.9.97:443 ieatpoop.info tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
IT 185.196.9.97:443 ieatpoop.info tcp
IT 185.196.9.97:443 ieatpoop.info tcp
IT 185.196.9.97:443 ieatpoop.info tcp
IT 185.196.9.97:443 ieatpoop.info tcp
GB 20.26.156.215:443 github.com tcp
IT 185.196.9.89:443 nova-sentinel.com tcp
FR 51.178.66.33:443 api.gofile.io tcp
US 206.168.191.31:443 store8.gofile.io tcp
US 8.8.8.8:53 97.9.196.185.in-addr.arpa udp
IT 185.196.9.97:443 ieatpoop.info tcp

Files

C:\Users\Admin\AppData\Local\Temp\49a243ed-7044-45c1-a9ba-5ed05acf481b.tmp.node

MD5 d6c776d3e3d45398909b8089339cffed
SHA1 1273ed2ed41e60d5829acb44bdf3b944be9ba4c5
SHA256 edce4206cca72b8358ba58e757cd312d2b9226845bc6f19f8f1ea9692a4dae93
SHA512 34124efe5f1ba8b7f49cff1105d4e3e3c71354e1099952a7300fb84c62b178ebd32545ca4f03fa8f7c903f1f6ae18980c6146cba25bc2e92674a9c42bcd93965

C:\Users\Admin\AppData\Local\Temp\bc788d4c-896d-4552-b2bf-b248489c01ad.tmp.node

MD5 56192831a7f808874207ba593f464415
SHA1 e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA256 6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512 c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

C:\Users\Admin\AppData\Local\Temp\bf60102b-752b-4709-bf7a-fe15db3e3b91.tmp.node

MD5 6dc80629358026270df0694074b8a18f
SHA1 49e0e9ec3c1aace0cb84b9f1f0fffa060ab31036
SHA256 9a19f419905559e6ca56e81937e273984b2f110103890ca761043cae71133a9e
SHA512 4804a5423a720b2e8ceab41c48cdddfa529d8cfff100de5a2810f20a016f33ffdd6732f39349428cd62fcf067ea0957bbecddc11b8462bad06c0f92055654a22

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pd4gpsmj.ggt.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1172-26-0x0000019B7C720000-0x0000019B7C742000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

C:\Users\Admin\AppData\Local\Temp\CMj9BY1V4uRa_tezmp.ps1

MD5 3bdb4acb30b66e04490cca9daa5ed55f
SHA1 7e54b6a043aaf4e05b7c41a8d8b65d4eb0bd9847
SHA256 c6ebfa1f886ef4a8b95272fc4c4b51213fd53954113925de6a0bc0a089b5c7b5
SHA512 2c8cc6a6bf378b67260a4a00aa6bd7b17cb70c884b677bdeb5bfc5c9e52f0ef0edf96ad30baa852221308313ca1c5a9f48215e7a2c81e548615649eeedd7cdb8

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6e5843696d70df783161968b9f9e1759
SHA1 6e7ab4a749b553ff66e8914563ca9f98cabe3ecd
SHA256 51f80b81fae4ad9aa2b195b561274799f4bab0b9c12b0b86748044f12bbab719
SHA512 5b44b40619c0467fc41009a5ca7638ae3ab948757c4707b8439c7485635d9cfb120406d76e330b0993f17f63739a7d8d40e3ae71574a89428501ab63a44e9093

C:\Users\Admin\AppData\Local\Temp\OmnAsh0yCiUCbHPD0W0b\System\UJHKQCDS - 2024-06-26_221533.png

MD5 2a2af5ccc719fd1df420ddd976d23d46
SHA1 5db868a9166b74dbd991f18363d85fad79d4de41
SHA256 ad7b479ecc354a4b16b1436dd9cbec42cd8fa3517ec2aef469959e8824ed49d6
SHA512 2195d1d09a28a237932b063dd8d975ec2d64a736aed8fd16f62197bbf3bc3c6392dba3bcc8cf915441004f686d7723f524883568531093ec6c4065580fbaede4

C:\Users\Admin\AppData\Local\Temp\OmnAsh0yCiUCbHPD0W0b\Browsers\Bookmarks.txt

MD5 dce29c08aae4beae5f112ebbc3ded9e9
SHA1 8d1181f990cbe2129cadc62e69c53d06da11d2db
SHA256 3738fe60a406e6f7494f8c65b5cbd43f635736a4839bfd318962809c311c5741
SHA512 e627da73f4c6bb352d0a46a84250f98ba31559e595bb5f7af410de1f5fa99c4f0cfc19ee78270cc3416e393c1e85fd6ef24b5493e6d03ba9998a3014184d9eaa

C:\Users\Admin\AppData\Local\Temp\GB_NOVA_Admin_191.zip

MD5 14395b0a43e71f793274e221b917b2c9
SHA1 8dd91631f9a8647bf9bc3ee38717428eb0a64eb4
SHA256 0f5b0f2af1ca3b324892797815f87ddb5d4beb36f5735c18c0250b8893e2e50a
SHA512 90665ede2d4058269679ca84b8bc455a803e29b28aabe662d298c7422da08ec0f4d2bfc9b879e941640dcdb0c6dca052fb88ab3aef4865342c84cde553376277

C:\Users\Admin\AppData\Local\Temp\OmnAsh0yCiUCbHPD0W0b\Browsers\Chrome [ Default ] - Cookies.txt

MD5 8c399c44ccb5fbbebf82dfcdb25a89eb
SHA1 0c2a1a92d635f879fdc9ecb04387360062972b0f
SHA256 cd7248ee481d8d8f50e56511aa5fbdd1df0479c6bb1058e671c4ca447ac8a1fa
SHA512 de2c37834cc5cf836be7c1ae8640f7b549f56a9d64769e591e5c8a6853f28315f468cb6e4ddb0dad0fca459b5351f583e2b43cec812c472dccce2d37da0b6660

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 22:00

Reported

2024-06-26 22:15

Platform

win10v2004-20240508-en

Max time kernel

12s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\arceus-x.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\arceus-x.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\arceus-x.exe

"C:\Users\Admin\AppData\Local\Temp\arceus-x.exe"

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=2632 get ExecutablePath"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where processid=2632 get ExecutablePath

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe

"C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\philhorse" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1912 --field-trial-handle=2100,i,3472315143393742066,2758316912591284007,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe

"C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\philhorse" --mojo-platform-channel-handle=2388 --field-trial-handle=2100,i,3472315143393742066,2758316912591284007,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "net session"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\System32\Wbem\WMIC.exe

wmic OS get caption, osarchitecture

C:\Windows\system32\more.com

more +1

C:\Windows\system32\net.exe

net session

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 session

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"

C:\Windows\System32\Wbem\WMIC.exe

wmic cpu get name

C:\Windows\system32\more.com

more +1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"

C:\Windows\System32\Wbem\WMIC.exe

wmic PATH Win32_VideoController get name

C:\Windows\system32\more.com

more +1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=2632 get ExecutablePath"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where processid=2632 get ExecutablePath

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 nova-screen-webview.com udp
US 8.8.8.8:53 www.google.com udp

Files

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\chrome_100_percent.pak

MD5 a0e681fdd4613e0fff6fb8bf33a00ef1
SHA1 6789bacfe0b244ab6872bd3acc1e92030276011e
SHA256 86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2
SHA512 6f6a1a8bfe3d33f3fa5f6134dac7cd8c017e38e5e2a75a93a958addbb17a601c5707d99a2af67e52c0a3d5206142209703701cd3fab44e0323a4553caee86196

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\chrome_200_percent.pak

MD5 c37bd7a6b677a37313b7ecc4ff01b6f5
SHA1 79db970c44347bd3566cefb6cabd1995e8e173df
SHA256 8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a
SHA512 a7b07133fa05593b102a0e5e5788b29488cb74656c5ee25de897c2ba2b2a7b05c0663ade74a003f7d6df2134d0b75f0ad25e15e9c9e0969e9453b7fc40b9f8bb

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\d3dcompiler_47.dll

MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\ffmpeg.dll

MD5 eda70f75c18fbc423f32d696e88ff302
SHA1 62d27cdfc9a0753b95501da75b6d81796ff70b2d
SHA256 eb015f75cd2e9025eb59a0f0f0d6d8cc397d96315dce6651cf7d8c42ab2f817a
SHA512 6245989e981a672bf04c4fac044fd128951ed75e972162d974027b49159abc8fb4398758de507d84689bf414029cea7637030f787ebfbeeba90f3b2839aec297

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\icudtl.dat

MD5 e0f1ad85c0933ecce2e003a2c59ae726
SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\libEGL.dll

MD5 3bec18862b4d150f18262dd13b17dd1a
SHA1 93384dd4e9602401f745c78815c6c36a5c94aef3
SHA256 03d8026e81f5ce02d663076d0703fa0b1c9cb53c246cdff5ffa8c99354e4589b
SHA512 c7b66a243256476bfc467b0a8171e707425b7da21b6beaaaca954b4ccb1eb8249b27c01e46a483af99ef2197beb88e006f8c6c4e65cc7acf39c603098468df12

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\libGLESv2.dll

MD5 22ef6d8f6b688e4f23739fc41a809b95
SHA1 0bda3ce05b756faaf5af9158206a7a6d3f2926a1
SHA256 17c4857fd36cb143331ce1402c8bb394a25c8beca48c5abe0616dcea6a4d19a8
SHA512 4743c16ffb3c18a950747c728082937ed30e6dcdc1afca0bad0f74eef0f47c42b02bb3dd48bb66ad2fdee041fdb71603c5500ed351f7c16e7622bb01bc4c2ffe

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\LICENSES.chromium.html

MD5 2675b30d524b6c79b6cee41af86fc619
SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\snapshot_blob.bin

MD5 6fcb8a6c21a7e76a7be2dc237b64916f
SHA1 893ef10567f7705144f407a6493a96ab341c7ccf
SHA256 2bceef4822ca7cc3add4a9dcb67c51efb51c656fce96a3b840250de15379959c
SHA512 3b745740bbbe339542ef03fd15dd631fb775e6bf8ca54d6d2b9cead3aa5aafc4cab49e507bc93641e581412bbeb916a53608d5f5d971ea453779e72d2294dafb

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\resources.pak

MD5 e2088909e43552ad3e9cce053740185d
SHA1 24b23dd4cad49340d88b9cb34e54c3ca0eb0d27f
SHA256 bba36d4d18d64d9627f54c54fd645c5ba459d25a59acc5228210bd707aef67fd
SHA512 dcefacddec38d8941c7d2d7b971b6f22dd0acb4116e48891d1d48a4d88968da12b152ccb7591715c88f8e14c315e235d1c4e6852cc38b9246091c50226900de6

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\v8_context_snapshot.bin

MD5 1a37f6614ff8799b1c063bc83c157cc3
SHA1 8238b9295e1dde9de0d6fd20578e82703131a228
SHA256 4fbe07f71b706c2a2948eba9a6b1979e23c83342b190723a6ec5251b2d6dad7c
SHA512 6677f65a0e26fdc2cff6cef0231f5e5f0713ee7c5cf7f488599a3c7ac3e8365afaec10b35d6145ea58d364151d8bcb08308765693a9797ea99b894d6e8224ac7

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\vk_swiftshader.dll

MD5 6462f53038234de8fef3e6fa31bb46d7
SHA1 8f610b8bf9ef943411c50b5d7862d616d2232b03
SHA256 95f6581afe35f4a89fad311fd8b49c3677b27233a9d0972da18593a4dbb94d14
SHA512 475bbd91b16311b2e24db67dd0ff4682730aef9e1a99d4dc9e5ac2734582f10a1671e383820a069255b5250bdeb76681268ceb049b9a8130d6de9db704d043b1

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\vulkan-1.dll

MD5 179c11146cb6a58d8fd631da7f5480ed
SHA1 47652ed572cafa61ae71bc45d65e77cebe0822ca
SHA256 43e4f96e6306d584f2cc4b29e56a24731ebf5471459faa8fa983ce8472087263
SHA512 184c056e20654f9d559c261526bd98805f4b4b8ae52a2e803777f58704414a3cfa7495c7bf0fc4d9e90356398faef03b42da91b7ef443a784bff86e1093d3910

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\ar.pak

MD5 3c2ab7363018db1f20b90acbc305cb4c
SHA1 60b9cf453178ad0e60faf20d137a0c7eabde65c9
SHA256 3ca47b9c436723f837a53b2904b51efdf13ab6cad2f3ef4fe48a1115847eccbf
SHA512 589beb3e95e93f30341933c9b9826210e6bf3e9c1ad8f113d9d8a98fa5a526f81e454ee3357fb55d60d67a4890ce33e964ba2fa810e1771a6b7e82746492313a

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\am.pak

MD5 3cfd7c5bb92ab72c63e003208a9e4529
SHA1 165d2f69ab6a6e237f0fec943b5577123cefea87
SHA256 12e9e1bec1c46e5ea706157726e17a4429acf288a5754fa183bd9b4cf7d3853b
SHA512 cd7c7837d758ea66abc871503cda6fe99ff45990405e60c1133e7c1f4cb29ee69723c9558bb2d3eccb42948da57351f4f095062616686ab2e255acd3c86236f0

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\af.pak

MD5 917a688d64eccf67fef5a5eb0908b6d4
SHA1 7206b01bbc3fd8cc937db9050dd8ac86cf44d8cc
SHA256 6981249837ad767fc030edc8838878a5e493fb08cc49982cffaed16cfbeb564d
SHA512 195dbec8463cf89990232296c5c927e1501f0c2e01a7be7c6a6acae651853ce1edb23d639af65979b39a3c61979119c3a305acfa3aadf0cb93e241c5e57f4534

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\bg.pak

MD5 a69f6075863d47b564a2feb655a2946f
SHA1 062232499ff73d39724c05c0df121ecd252b8a31
SHA256 a5eb7038ed956bad7704a722f05691474ff709dffbad92b8e31dbb869ad58334
SHA512 930ce3938aa02a8bcc609a64bd86b7e6164d63baad157a980fd079859a6bee5db87bd1f7a74a71108f8368bc9c6154bf14a2dba1abf269f572bc262614bcf1db

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\cs.pak

MD5 06e3fe72fdc73291e8cf6a44eb68b086
SHA1 0bb3b3cf839575b2794d7d781a763751fe70d126
SHA256 397134d1834f395f1c467a75d84ef2e8545cb0f81e94dbe78b841fbbdaad802d
SHA512 211594c30ad4f5ca8813596b59751168c60dfa0d13f24f2aa608fce82d21c2de3de69fe007c4bde1602da8aa7ea81ec0f15e173abc1224362c36b493b425b425

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\ca.pak

MD5 2d30c5a004715bc8cd54c2e21c5f7953
SHA1 fed917145a03d037a32abac6edc48c76a4035993
SHA256 d9c45d55a9a5661063b9bbebb0615de8f567f3925d04fd10938da9617c6220e0
SHA512 b3803551f53d290d8839789f829afc9c1e12052c81ba20d5e01fb3d2bacd5d1e97bd4c05074322eed17fdec04c9176c655076faec8a3aef17c39fb999e0c1fcf

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\da.pak

MD5 1939faa4f66e903eac58f2564eeb910e
SHA1 bace65ee6c278d01ccf936e227e403c4dff2682d
SHA256 0b9da7bd6531a7ebe7d8188b320c0953adcfbaf654037f8265261a12e63d3c87
SHA512 51588d2fe724e6c407724ea6f46883ded39397af744effaf672f75952a6a734e61e93e59f446080317f2a2b3fa1b45e7405f90fe0b226c44c9f3dd9a4e130a87

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\bn.pak

MD5 d43ce80ddca3fab513431fa29be2e60a
SHA1 3e82282e4acfec5f0aca4672161d2f976f284a0c
SHA256 87670ff2ceb1ebc38fce2c3b745ac965f3de5de3133d99ed33933a8f3e99d874
SHA512 1d33ca9bacb91ef328f89a14777a704000bf30fe59aa1cbbbff34d8bad266c98d78c9e411e289e834e76eb721dd98934426a565cd5b3436d5a103abe37f7612a

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\de.pak

MD5 2163820cd081fdd711b9230dc9284297
SHA1 c76cc7b440156e3a59caa17c704d9d327f9f1886
SHA256 6d787033c94755cc80c187ed8a9de65808bb4d7968354bbb94b7868ac2e8d205
SHA512 920fa2a10f7aa7f1f6d911fe2a77eded0384617d8fd863943afd99a584dab3fb2ea3e5d2e20bca529689a99fdf303912007f2918c62482d8a90194a810f6e535

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\el.pak

MD5 a14d8a4499a8b2f2f5908d93e2065bf7
SHA1 1473a352832d9a71c97a003127e3e78613c72a17
SHA256 eb46d9860835b69d33b2583d1e52b20238b666b967bf00906424e3c8a161ed64
SHA512 427271d12590f8ea3f11b83e4c0ce79c55c289573c5f6e5c70c789b28a5181f295a3c9b1a4bdd1f731f338e6edb1e06318ea6410ceac546128a84ff8f2ec0b40

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\en-GB.pak

MD5 9d9121bdc9af59b5899ce3c5927b55d8
SHA1 568626a374cd30237c55b72c74b708da8d065ec1
SHA256 f4d45ccc89834376f35d4d83fe5b2d5112b8cc315fcb03228720749aae31c805
SHA512 149a8acf256dc12f62706f72ad8ec88cbfdf7f8dc874bcd9facf484cdb00e7c5787f5e1bbc12b5bbe1b19b6524e7e8a1c7dba2838abeb9aafa3ce89795fd22ae

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\en-US.pak

MD5 626f30cfd9ad7b7c628c6a859e4013bd
SHA1 02e9a759c745a984b5f39223fab5be9b5ec3d5a7
SHA256 0fd74bb69ad35b3f9391fa760bf0eb0ee73d2bea0066244577ef2abd269513de
SHA512 9ce902f21fef70c5b5af444b532b36c9a00d896878cb4021c9b1dc07aa3277d956bca65ee0adb68467eec113e535b60a8a5fb5414c7d0ca761ceae5c43b7d9a9

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\es-419.pak

MD5 6f4613a4a88af6c8bd4ef39edeee3747
SHA1 c8850a276d390df234258d8de8c6df79240c8669
SHA256 8f7b8776e61e3ed5aa33b1a571ac834653b54b12a499d956b95d567b7e1ba987
SHA512 e5933dcb2aaaa2018ba8b13f4af3dc8a950640ac60acb1b56ad6de24541701d0ffc1f4cb28c7932af924bfd673edcee20bf649156ab95ea9499ec43c703ea141

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\es.pak

MD5 a24e01a4947d22ce1a6aca34b6f2a649
SHA1 750c2550465c7d0d7d1d63ad045b811b4a26dc55
SHA256 848d422be1b8fae74786ed6d6dfa7dd2e97b798b4a9ba1d929085e425b2a54e0
SHA512 02fc4ce96aa523ebc204243bbec3347b09cb20bcc0ba66cf9532a6fb26c48f7f2396bbb833f1916f8f081ffc9c6cd2de07315e66c5115042a0b44270fa4468c1

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\et.pak

MD5 82a07b154cb241a2ebe83b0d919c89e9
SHA1 f7ece3a3da2dfb8886e334419e438681bfce36cf
SHA256 84866ccaf2ec39486f78e22886bef3fe75c1eb36e7a7c071471040e12018db28
SHA512 07319d155bdf9e27762ecb9ef6871430bef88b1af129450eb65aa798ebaa4e02b25b0cf9bde3b12ff1b04a3d14241569b73d6af895d2e85dd7b24d393e7317e9

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\fa.pak

MD5 c770cfb9fbabda049eb2d87275071b54
SHA1 20e41b1802c82d15d41fadaf3dcd049b57891131
SHA256 dae7e7c87026cd4e8a4cd813cc71def32c86ed47865ce6da5383b66b7021c5bc
SHA512 cda117a60c853f12ade579c34fce22d992b33df1f5001a237767b6e642d5c775c3387bcee05d6557fe5a2f6235f93258954a697d3b9812d2550c4801869f4751

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\fi.pak

MD5 fe011231bbc8b3a74652f6a38f85bc88
SHA1 2b851e46738d466b3a5a470de114d15051b6eb6b
SHA256 7a3249514585491eb47fe4b579edc27ccc48761e7ad6bc11d113b257132c5dd2
SHA512 2a4e5c1409347b4b514556c81ef32c8ae118add28e3469717b13045c8424fed9b817c7988629050ed3e732e0cdca181891b6a8b9e64e4c8d65f004d7c8db9796

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\fil.pak

MD5 7354de570c8132723c8e57c4ccb4e7c4
SHA1 177780faf460e3c8a643a4d71c7a4621345a8715
SHA256 91149190c856195fb330605686acf09c7197e5b7efe37fe2a7c76bb8fb08cc89
SHA512 a8487a6a7fd46d62e78ca4262de49e12c120268561ee61a642c45efa48116edebeb40cf9e8be229db0bbf06bb6b5457cc54399a08ee6a603e5540ef5ca482798

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\fr.pak

MD5 d8b4bc789a0c865fb0981611fb5dcdbc
SHA1 33f9f03117f0bba56a696f2fa089ba893ee951a2
SHA256 52aa0a18ace6347b06a89e3851a1b116812c022dbe41da8942278878b5409cee
SHA512 58d19e5a3c68c901fa2a0c327a45b410ab9b9e6c39298db48eed25345453dce1a4633afe6277cf53ed558e160065b89c0e38a32caeced47e79783dbda4d74f26

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\gu.pak

MD5 225167dbdf1d16b3fafc506eb63f6d1d
SHA1 8651b77f41e3c5b019ccb124a7c8f6449a04b96c
SHA256 ff379dd77136b9b85e7e9fcb5b261ace9c6d9184af3ba2dea35b1757b9bab6d9
SHA512 a353d36a87b6608578816056647de45a456f9012d399b2cb5cb7b9de867a370fcaf1a90d293f367b9b678d13991294425abd85cf77e971afa0d3e9c316952115

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\hr.pak

MD5 af7aec4b45ead620463b732e16f63e47
SHA1 e6838c56b945c936fdb87389fdc80cdf7bc73872
SHA256 bfeeafe2f8a9f797d20c4209181c4768fbea4a61ff2dc1f57f6cd18bc872fc13
SHA512 784ff8dc6011883e931b4b8371e5ada960120931bfdf24f81648f5092fa31db1d03e5d3cf5cd16d57ea7fb7877bb25a28533085ab42bfe40dc25ca7d9cee7ade

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\hi.pak

MD5 9e1788b0f3e330baf2b9356a6c853b20
SHA1 a2f4b37a418669e2b90159c8f835f840026128d9
SHA256 c640313e10e985a58d16f928d2428ae278421a070d948733ac68fdf7312090fd
SHA512 b9a577e084f8daeb53fad0a9423661c99cab272125899a16b0b052606a2cb88f823137f3a21b5c06b10e0235321b7faca84cd759bf406fb2dd02c2f598e92cb5

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\he.pak

MD5 d8320b09c1e138b00655db0802687bca
SHA1 01616bda6b22c70d5c6440b7451ae736eb1336cb
SHA256 e3336668aad9ad661e7f589f1a405b9c95fc771261cdf9328aca88f4be763374
SHA512 5a91596d7e82dc3d692083ae45aff6fdbddd08ca17f49a020e0769f98c4218b6c9cd31e54524473b7cdccbebf4d7a7f0ff23b5075a1e1ada5cc35c3fd0172bed

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\hu.pak

MD5 b93beeb1e35a29b310500fa59983f751
SHA1 45c0b2cab4c4a820cfc2aed4b7236ddc79a0db00
SHA256 bab09c3cb80130a4a288642633c2b31ab08b1757466d9a468bc36d276079f002
SHA512 249de5b8bd7c4755caa8b9552254d353b0d885b63bd5f7c6c8e29b3f4e447c9e8d6c0e88d5aaba0b898aa26880592b3904e19ca4797a2ac1dd757aaee782c37c

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\id.pak

MD5 bc719b483f20e9a0b4b88969941c869d
SHA1 4d926a9aba7c350e9da8aa570a9f52534c81aa88
SHA256 f175e58be47b228803aa32d2695e2fcfaf4655b65b96fb6b539b3e59593e6799
SHA512 ddf6108888676c1a90865daaa88198b681b685d9047b0e10f5aa08daa39a628a84732a8518606176529297bec51ce8bc39e910eeffc8b88e9585fafb694c35db

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\it.pak

MD5 ab160b6e8bbaba8f8bde7e2d996f4f2e
SHA1 eb7eae28a693337b8504e3e6363087b3b113bc72
SHA256 e86ba661b3f6f7ecd2312fe90b873330c0d6516a5501a0f326875844e8d4b289
SHA512 14e8919e2f5a7ad2b3f310ffec590b221e6e0dc45f37efc57ff9b8ff7a3ca674d6f4b9bd65e49a98af6726fa953f2168e5c8e6101ed977e8c7ff4a51203f8d4d

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\ja.pak

MD5 dee9626a8d7cacc7e29cff65a6f4d9c3
SHA1 5c960312f873ab7002ed1cce4afdb5e36621a3ce
SHA256 63ad3974baa8c160ba30448171f148d008ac19e80010fb13d3a65cf411b67ae0
SHA512 ee80d58886f4ac378d6491e075062c171a715af7c42dd1785952b25a572381acd722764e8be914adbfccf2a5fa4a51968b989b632eefb9d636851f1b8ffb82e1

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\kn.pak

MD5 32e5f528c6cee9de5b76957735ae3563
SHA1 74a86191762739d7184b08d27f716cfa30823a98
SHA256 cd297f7e872b34e63ca2d98dc2fa79085e8a2985ba8757601e4b901a3f30b013
SHA512 92d100b1289e63fd0dc65657fb4b1e16f298735e6cd066e9122d04e3b79e0d286f15fc9f1da2c3a05af528b92bde95fcfbc493c466db2d94a0749adfbf7fb8d5

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\lt.pak

MD5 3e9119a712530a825bca226ec54dba45
SHA1 10f1b6bf2fa3a1b5af894d51b4eb47296c0dbc36
SHA256 3da531a9a5870315823e74b23031cb81379d2d94ae9894a7fb1d8a8ad51a2da9
SHA512 765c872cafa1b266575b0cac09dfa796cdb860bd82e1c657397fe2aada11771f306b0a1776e4d66ff41e94b153c812592430f31e7b1ff97abe7d8e6b96d321f1

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\ko.pak

MD5 38a95d783d627e9a83ad636faa33c518
SHA1 cb57e8e9ef30eb2b0e47453d5ec4f29cea872710
SHA256 0d9b23e2981412d11ecea3ade8d521a073802d9431c39d72b88f62b98e50a96b
SHA512 4119b8f82107473c941c9e10b6bae97d60c9c47570cc2b40f429a95f4f5cca77eecbacd7023af439429026f6e55ad9df19998c8b98be0d04d384b310d025c0dc

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\pl.pak

MD5 ba7a9aba68211d8639dffae0ef8b88da
SHA1 a9a26b8f0902475cb576967cbe9013028cb21da4
SHA256 60aa08598a81bb46ddc64a5ab0852565554c6e6262e9c5dfee09f4e3fc08d5fe
SHA512 a1b8bfc3e19aa1267e31838e1c1f2b0b1cfcdf56f84e967088d626b58ec64b3305043a14b12fd080498ee1d74a4192453914c393ce8f848ea5616cf88abc4eb5

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\pt-PT.pak

MD5 0237374730fa1a92dec60c206d7df283
SHA1 62dbbd855d83ef982a15c647b5608dafb748745a
SHA256 2fb2fd2e32b952dcbc8914f9d3aaf02bf2750b72abfee2e8b2bb08062ddd9934
SHA512 63ec4ec44002724e22703a3bd952d1ff4062b367c4f5e3f106349bd226ad1317bef2e371fda0e099ea5c0afd32a9d2c1246c93c18d73dccf8fc2c1644a6fb6b2

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\locales\pt-BR.pak

MD5 53d5fb849c9bab70878b3e01bffad65a
SHA1 e72af1a76539e66cef4a4eef5844b067a4e1a79f
SHA256 40dd24c5e225ed941bbaab3dcfefa993e39fbc75a1798f4f6e06424956698ac5
SHA512 55357643d789d2eed72e009f08f72ba4895ba455ca00c8347a3c3790e43f8d7e4625feda438ecac840bdc52c26d2135d89bea693b61a293922b6056bde6b4516

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\nl.pak

MD5 7fc6ae561fd7c39ff8ba67f3dbaa6481
SHA1 2e3977403a204c6f0ca9a6856bb1734490a57e72
SHA256 844031e1de2b2872d12d5b7d42adf633c9d4b48169b1b33b7492b3b060c73558
SHA512 90294ae24b7db003bc34a48f98d9e1887e87c6f605defe01ddcf9187429e8446c04a7f94bb6aadc8e61c98842163bc3702b414393ab836eb0bee038f09481c2b

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\ru.pak

MD5 1a9b38ec75ccfa3214bef411a1ae0502
SHA1 de81af03fff427dfc5ffe548f27ed02acae3402d
SHA256 533f9e4af2dce2a6e049ac0eb6e2dbf0afe4b6f635236520aee2e4fa3176e995
SHA512 05cf20aea71cdd077b0fa5f835812809ad22c3dbebc69e38ab2c9a26ad694ab50d6985aec61633b99713e7f57408c1c64ce2fb9ccdac26661b7167853bdd6148

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\te.pak

MD5 17b858cf23a206b5822f8b839d7c1ea3
SHA1 115220668f153b36254951e9aa4ef0aa2be1ffc4
SHA256 d6180484b51aacbf59419e3a9b475a4419fb7d195aea7c3d58339f0f072c1457
SHA512 7b919a5b451ec2ba15d377e4a3a6f99d63268e9be2865d674505584eed4fa190eaae589c9592276b996b7ce2fdfae80fda20feff9ea9adbb586308dfd7f12c2a

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\tr.pak

MD5 55e06cd9356d0fb6f99932c2913afc92
SHA1 aa5c532ddb3f80d2f180ad62ce38351e519a5e45
SHA256 afcbf02420dc724059f70d1dc6ffa51f5dd75136d9e1e8671d92d5d14955edf9
SHA512 813c180cb1aa205034497be5fc8a631ff117e5ed17cdf0ac59b7569d74d849b385852a15bbadd3146f942c58bab80d94bf0980d13ca4b4424d1cb1df0cb1a2cd

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\th.pak

MD5 4917873d8118906bdc08f31afb1ea078
SHA1 49440a3b156d7703533367f8f13f66ec166db6e9
SHA256 d051b400096922089f6daa723fac18c9640ba203b2879aac4ca89b05738dd32d
SHA512 30e6446bad54b86be553fa293c7a92ec221adb54b99624ed69702df75347a98697158041a45f77ece4e7ed0fda41306ef21eb27981f24f0a4e42e8306175a88e

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\ta.pak

MD5 5f80c9da0c09491c70123581a41f6dad
SHA1 3fc9560a954271cf09aaa54eec34963c72c06e85
SHA256 30658d99d753946e9c9c02094c89be25b710db77251df6cd1a8839c29de5f884
SHA512 072c5db7fe1eb9e6c270d0e9b439cf84ebb3dc374d4f01f01f9341030883f2d6d9c6970fb6ef14bf96fccb51eade9ca762f396f89ba1d3df1230dda68557fd4a

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\sw.pak

MD5 59ff4e16b640ef41100243857efdd009
SHA1 f712b2d39618ffadcf68d1f2ab5a76da5be14d74
SHA256 c18a209f8ec3641c90ea8ced5343f943f034e09c8e75466e24dcabc070d08804
SHA512 0e721a6cbf209ac35272ad292b2e5000d4e690062ddb498dbf6e8e6ee5f6e86d034a7303a46c2b85750245381c78efafc416ead13c1fe0ee5ec6088dd66adca2

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\sv.pak

MD5 e4c9ced1a36ea7b71634e4df9618804f
SHA1 c966c8eb9763a9147854989ea443c6be0634db27
SHA256 e5cccdb241938f4a6b9af5a245abe0e0218c72e08a73db3ed0452c6ddfb9c379
SHA512 d07a4d62f22a1830d3ec44f0c347e4a7d70b35ceba126cbdc246a7b3ee7eda85e2338bab3edc7223f579964868136bb10d42c05e0e0ff9f73447b3606d9b2c4e

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\sr.pak

MD5 8f58b2463e8240ef62e651685e1f17d8
SHA1 6c9f302aed807a67f6b93bcb79577397a5ad3cf7
SHA256 5a55320d6953efb5b565893e32e01f6dae781a16460df5502c8ba012c893edfd
SHA512 6076d43a73d5fa5192cbe597e018b268cfdc7efb94a6cb45dad5b0da9c3abf68aaf2ea06f3ad650b28a993605917b6d356339d79f8dd6962d2c40dbf4653ef83

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\sl.pak

MD5 435a2a5214f9b56dfadd5a6267041bd3
SHA1 36bbc7ca3d998bfb1edc2ff8a3635553f96ca570
SHA256 341c33514c627501026c3e5b9620cf0d9f482ab66b10a7e0fb112c7620b15600
SHA512 55271935e18ac27c753431af86a7dcd1f4a768adef1b593ba8e218da34856a5f9faf9819a3ecce3f21f0607ba95100c5cb18cd1a7138ec563090d0391ad5b52d

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\sk.pak

MD5 f117e58e6eb53da1dbfa4c04a798e96f
SHA1 e98cee0a94a9494c0cfc639bb9e42a4602c23236
SHA256 b46db20eeba11f8365296b54469fdd001579852dc1d49a01fc59d2a8bcf880a3
SHA512 dea792a63e0557d9e868c0310ec2a68b713daf5cf926389e05a0885cdb05433d20f35d087de269f9584795da50600966b8ff5dd95583861443a1e90564a89793

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\ro.pak

MD5 4e692489e2ae74a4a11ca0a113048f15
SHA1 cb2b80217d5372242d656ac015c024fe1e5e77b7
SHA256 4a2a305668f1926cfe4bb72e8fbfde747c83ac4dd9cf535c13ae642d0b96fb79
SHA512 8ad9e0a79137a862def24d6963536e75b87bb71ab74dbdd43531c5c95ddd3cd834f22c6a8e3a1e03aad35ade65ecd227d5101b5be3ce3f0b7b471f5136cfd77c

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\nb.pak

MD5 28cc86c7204b14d080f661a388e7f2c0
SHA1 e0927ea3c4fd6875dafd7946affb74ad2db400f5
SHA256 9253122d94ccea904fb9363b8178ca9335b8380b7891f1a7a22afb3113309e72
SHA512 e2524e10d145f95c028d65e47cf06fc82c7a43fcf0ecf01202278c7fb14079c03e9434e8039fd96aaee870872c9896d9f0ed575e50c19a3781cb0c94fe59b3a5

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\ms.pak

MD5 73096184d7bd6a9a2a27202d30a3cfa1
SHA1 ea711b29787aa8b9e9af6bde5b74103429e5855f
SHA256 d1072514bab63af5dfbf923175d491787139f0c1b6361acb23e67543836c84ba
SHA512 e3fbee4896554e502c222b5ffe38e9d61e9db4d18cdc92ce5118b819dc60789bfd6d6c7f8444ff1763222455ab91e79bfe500e75c0e06b0de70c2c64fb043c6f

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\mr.pak

MD5 fda40999c6a1b435a1490f5edca57ccd
SHA1 41103b2182281df2e7c04a3fff23ec6a416d6aa9
SHA256 0ebb125a0bdfd1e21b79914ca8e279790d41f7bac35bf2d031dd7981f1c1c056
SHA512 666ceb24d2e568a00a77512295e224a6545bf6abcfa19c93aa823db5330117fcb39fde570e7601dbd41976950c3ec03634f89fc5d9203357515e6651ab0b6d32

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\ml.pak

MD5 6e96eddfe80da6aaa87f677feef4d1d6
SHA1 8a998785d56bc32b15cee97b172cd2dcdc8508d9
SHA256 e2fb73353ab05eb78f9845bdbdf50b64c9fb776b7f08948f976fe64e683397c4
SHA512 feea11dfc6ec153ab903b5828306617eedeee19daa73bd046ae47757795fecb9abce6192bb3a9561aaace7fc85ee442057b93081c6c986855b819fd38815e6f7

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\lv.pak

MD5 e75cdda386dd3131e4cffb13883cda5f
SHA1 20e084cb324e03fd0540fff493b7ecc5624087e9
SHA256 ae782f1e53201079ca555baa5ec04b163188e5161242d185f04a606a49fc8c0d
SHA512 d27bc61028031946ed6708918f921c3d681c8962b8d5507a91ab6576e3b2c462524e550305db87ede886e41fb0e49edec2d84cdbbad675282105627e01d98bf5

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\ur.pak

MD5 861ffd74ae5b392d578b3f3004c94ce3
SHA1 8a4a05317a0f11d9d216b3e53e58475c301d7ea5
SHA256 b9f22a23368bf1e21f3085583ecb775cce8045176721ff6ae798b06bd2810dbc
SHA512 52ede35b7ed1fb6e51b18e450b95c3245d326f2afda646e3642ee68b714dcf9a726afe32e2759e9ea87a104f4a59e6fc2c60b3275aad8332ae1c626231e6747b

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\zh-TW.pak

MD5 f466116c7ce4962fe674383d543c87f6
SHA1 f65bf0dc1f1b15c132674fb8ff540f7d2afe1d6e
SHA256 ff3a294fd1afb1fa7aaf53fbc4396643a12ed132633c5c86f14c16b88fa94a7b
SHA512 4851a08069fcac75e4051e53d4526789bfe6c393ab963e8263803bbf6e96cb150e9ba741650efb5ee500e8a757d8512eb17dc268cec1ab6fd3acfac62f7da27d

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\zh-CN.pak

MD5 3210460a24f2e2a2edd15d6f43abbe5f
SHA1 608ff156286708ed94b7ae90c73568d6042e2dbd
SHA256 0f8d42d7f0b0b01aafad6ae79f0bd0ca518b2db94287b09df088bc093f15f605
SHA512 f97427dba4217e01a7ed395c453d03dda4f2258cba589258da0eacfde427bf442cddef541a23e7782914433e70a9623e904a5070deba9f9d50dda20732eb5e86

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\vi.pak

MD5 4076d3c0c0e5f31cf883198c980d1727
SHA1 db51b746216ea68803c98d7c1a5a2b45944359f3
SHA256 f1458c4ce4ca708e849eb0c68a5157360ef003f3a9c95628d5ca12ada303b379
SHA512 80e4e960218f7d84423124c34352251411baf008e821a344a0b6c2e7f1483694010f28b7de21c7e2c69abb4ec92e0d9cbddeed6279b90c47245f4cbc500cdb77

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\locales\uk.pak

MD5 381cb33c2d4fd0225c5c14447e6a84e0
SHA1 686b888228f6dd95ade94fee62eb1d75f3e0fc93
SHA256 c2a6b16abeab6e18276bc1636555e93218763b9c99cacd0b42481b35e3a11820
SHA512 f7a2828aa4cd85f07a5d66832f247f70951abf34f81a282dc41ec51875ba70d940353d010b605c56cc59bee47309aa311099d4e6ebd17f3c1538521d0cddf4b6

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nsw5787.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\ffmpeg.dll

MD5 1ab47cc842e5e89d3ce73e72909178a9
SHA1 bf72e0aeaa0a709f7446fd1d680210e7e2d1c5ac
SHA256 b52a2772fde68d542f70a3e09cf7550de2dd2ef8f53f67244e7a28572d7856e9
SHA512 02e03e6eede4a77f2f9101a621d52fae2d63dc223ef38a7f540c5c3d6f34b6b136c7ec4bcf411ef737d6fdc49189804a46e977688f3e9bd98babafeafcd9e5da

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\ffmpeg.dll

MD5 4f8e0f03ed6a7008dae2936d3f4e0c49
SHA1 1f6eb943404420107edb21f08cb28728a52e114a
SHA256 3de9e7df0923ecb659857000411fb86c049c2bb7f73dbec7f7af97ea389093f8
SHA512 ffef97eef480700e6d8564c154bd1ab13507ba0d5e9c81de561f3a2424346ea27434685e2a7f1abe974d344d6787913a0256dcea51788c04b62b81ae7a7f6981

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\icudtl.dat

MD5 351094bc3eac8d3468239e4c7157369f
SHA1 caf6b75e3b86fb71bd1f27cf371f057cd7fec159
SHA256 15baf6ddd6e789a4ccc2587974f151b9c62fde9b90fcc94f31676b65d1d37609
SHA512 f034eddcd2653603a0cbd2fb7683e3b31d73db00e9c514a68a72a103c19c55a0de20470aa6375dece8d35980f2e1906b4fd01b01214f340055400764f3b1bd2f

C:\Users\Admin\AppData\Local\Temp\d218a56b-cd5b-4a2d-8690-c2799eda634b.tmp.node

MD5 d6c776d3e3d45398909b8089339cffed
SHA1 1273ed2ed41e60d5829acb44bdf3b944be9ba4c5
SHA256 edce4206cca72b8358ba58e757cd312d2b9226845bc6f19f8f1ea9692a4dae93
SHA512 34124efe5f1ba8b7f49cff1105d4e3e3c71354e1099952a7300fb84c62b178ebd32545ca4f03fa8f7c903f1f6ae18980c6146cba25bc2e92674a9c42bcd93965

C:\Users\Admin\AppData\Local\Temp\b2feb159-3314-44c8-acd7-038c1287e987.tmp.node

MD5 6dc80629358026270df0694074b8a18f
SHA1 49e0e9ec3c1aace0cb84b9f1f0fffa060ab31036
SHA256 9a19f419905559e6ca56e81937e273984b2f110103890ca761043cae71133a9e
SHA512 4804a5423a720b2e8ceab41c48cdddfa529d8cfff100de5a2810f20a016f33ffdd6732f39349428cd62fcf067ea0957bbecddc11b8462bad06c0f92055654a22

C:\Users\Admin\AppData\Local\Temp\23931d06-b8fe-4a57-a539-33aa1cc2bf20.tmp.node

MD5 f9f14b237c112c24a00d0d14e92f2d85
SHA1 f8cbab426d3198722a6bbbcddd4219e0612de666
SHA256 221273e26628e16de9ae3dea251b977029c50c7200ab13a11045f7a510c78881
SHA512 192bbb1e5b770303ff04a7be5e267d4b4bf453fbe08a8e9029b097d805ab509605e5944f750d7da6ec519cd150bcf1ae47099d749e2736d91671bdb0c4195538

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\ffmpeg.dll

MD5 0a40449b4cfa10eff2cff127a4622eaf
SHA1 9b153b39527e9cfc70b6fab35b8f261f59fd3256
SHA256 65bdb2881b95fa21f3a80b4af7b546089890f573b23e35f77ee5be8328d576f0
SHA512 3dbc4ab206bcc110f83d25a5447611fab0bac78130e36b179a3345f5e859e052f6478858ea17432b6f3e0e68e6ced321f2ce7fb6278098acc725bad296990b4c

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\libGLESv2.dll

MD5 2ef3c777ddcce68dfafff0116a4bc0d2
SHA1 b4e1a3bb496f7f5a5e2acd8351a1f94616a0bd7d
SHA256 eed37ef7085539ba6714e6600a7665025382c4ab3fd90a00356ffe56b203f7b8
SHA512 aadf8f11e63a246e118a7ad0c47dadb4da53942d3bb7645841cd960ad3cbc93fd1f447eac997aff448fb346ea90f88708bdcf2f451f20f3962d75f6ad2937272

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\libglesv2.dll

MD5 9e8d2d8255ec2a24ba26ee9edf42ba10
SHA1 2c19cc953e742324e1697275e1b52b56f00ae3fc
SHA256 d59b1016a153512d5fc15c04ef8727741b47bb470274c1b0b0b59a2903dfaeae
SHA512 712468e2a6ba3194cdbb5182117b53164e2fa203dfc51bfe37d85528a75e0b5f3b05f6f29dac82f63800404f92b4b9ec46d8862c43c359b03d7200d07c0d5d76

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\d3dcompiler_47.dll

MD5 d4b2769128379410ababba4d4253b1a9
SHA1 d3ddd25f65cfc20037c49ba7f817abdc010ef667
SHA256 45c45b998d73e2aa1ff16f0db76b9ee100108f0b0719f897a9d630f9e6098716
SHA512 e1c7d39044300a66226fff99c8a32286d005e1e9777073b2bff8469530addc60dc589b389800b3e8be1c7ded5f295aa4ceca6687214dfea8ca4f9f2d643157c1

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\D3DCompiler_47.dll

MD5 13e8988bb49ccb6527851fe14b48ce0e
SHA1 ef1032ee9d438cf2f947c09f5e0986e48faf6dc5
SHA256 d674e210e0106c1b38d42454c7cc7c2111854cd6b3f9079e75ebd81bd8b154fb
SHA512 21d26dd527dd86c2ad6fa385856741802685bff898d52470b3c56f15344b9b2232b3d605ee7db1b54435de62b39c14fdce8d485c0a696fa64ddcdaa0bf265d2c

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\ffmpeg.dll

MD5 b0d17e98ce0cafc0886b820fa7904a79
SHA1 40c5a827ab18a645fd191d7de4dda88803da309b
SHA256 d696c54730c06900c8cd439f54f4b679e828c4cff5d0118b09534e3d4554fff5
SHA512 3f94ce764fe278c8bbeabeefb27475786f2204d823ad18464434aad61b42361dda47c4149908cdd4b27caf58fdfafa1ef6d188c9e06f0e57e82722f74b570086

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\resources.pak

MD5 9220937f17b192315336d5d8393898c2
SHA1 c6662a03b5516232a1bfbafa225158a7b4468ea4
SHA256 bee7a6d9d0bb569f7482777b228a1535ba40b9c47079d81e14142e7cd7d5085a
SHA512 cb6325c37e018c5261f9af5684ac0d503ebb7356c848dc4b6245c842b6bdfeab873100e08dfb1afebd7717733211dba4f09da892c5dd2684b9213f45ae729d7d

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\vk_swiftshader.dll

MD5 958a69a000ae0e538325cfb0709c15b2
SHA1 1e63ac9001ac66f67ed6061e7ddf699a70c88b89
SHA256 500b2a5fe9eef1d50cce860544adac6189c3aeecbc0677745da18d5e9908053c
SHA512 795a032358abd5f10b2fa99bd5fc8a33fa357917475d93ac76af79f8429602c1cb90724570f63c715cbaa3f0a448ac975f5378adcde7e26ffce01c1446c291f7

memory/380-579-0x000001EA74610000-0x000001EA74632000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4o53eh35.5fh.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-26 22:00

Reported

2024-06-26 22:15

Platform

win11-20240611-en

Max time kernel

27s

Max time network

25s

Command Line

"C:\Users\Admin\AppData\Local\Temp\arceus-x.exe"

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDriverSetupm8vObU = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\arthe.exe" C:\Windows\system32\reg.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Runs net.exe

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\arceus-x.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 32 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\arceus-x.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 32 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\arceus-x.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Windows\system32\cmd.exe
PID 2988 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Windows\system32\cmd.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 2988 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe
PID 3252 wrote to memory of 1528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3252 wrote to memory of 1528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2988 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Windows\system32\cmd.exe
PID 2988 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Windows\system32\cmd.exe
PID 2988 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Windows\system32\cmd.exe
PID 2988 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Windows\system32\cmd.exe
PID 2988 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Windows\system32\cmd.exe
PID 2988 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Windows\system32\cmd.exe
PID 1276 wrote to memory of 660 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1276 wrote to memory of 660 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1276 wrote to memory of 3988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com
PID 1276 wrote to memory of 3988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com
PID 2732 wrote to memory of 504 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2732 wrote to memory of 504 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1416 wrote to memory of 5072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 1416 wrote to memory of 5072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 5072 wrote to memory of 3928 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 5072 wrote to memory of 3928 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2988 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Windows\system32\cmd.exe
PID 2988 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Windows\system32\cmd.exe
PID 1792 wrote to memory of 2192 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1792 wrote to memory of 2192 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1792 wrote to memory of 1648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com
PID 1792 wrote to memory of 1648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\more.com
PID 2988 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Windows\system32\cmd.exe
PID 2988 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe C:\Windows\system32\cmd.exe
PID 1268 wrote to memory of 692 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1268 wrote to memory of 692 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\arceus-x.exe

"C:\Users\Admin\AppData\Local\Temp\arceus-x.exe"

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=2988 get ExecutablePath"

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe

"C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\philhorse" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1912 --field-trial-handle=1916,i,8911553424463885599,12794983828596479259,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe

"C:\Users\Admin\AppData\Local\Temp\2hhbFUY910kkiMoQiwo7208VSEs\arthe.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\philhorse" --mojo-platform-channel-handle=2096 --field-trial-handle=1916,i,8911553424463885599,12794983828596479259,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Windows\System32\Wbem\WMIC.exe

wmic process where processid=2988 get ExecutablePath

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "net session"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"

C:\Windows\System32\Wbem\WMIC.exe

wmic OS get caption, osarchitecture

C:\Windows\system32\more.com

more +1

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\net.exe

net session

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 session

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"

C:\Windows\System32\Wbem\WMIC.exe

wmic cpu get name

C:\Windows\system32\more.com

more +1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"

C:\Windows\System32\Wbem\WMIC.exe

wmic PATH Win32_VideoController get name

C:\Windows\system32\more.com

more +1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=2988 get ExecutablePath"

C:\Windows\System32\Wbem\WMIC.exe

wmic process where processid=2988 get ExecutablePath

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 110.0 (x64 en-US)""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 110.0 (x64 en-US)"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProPlusRetail - en-us"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VLC media player"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2BB73336-4F69-4141-9797-E9BD6FE3980A}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2BB73336-4F69-4141-9797-E9BD6FE3980A}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{64A3A4F4-B792-11D6-A78A-00B0D0180381}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{71024AE4-039E-4CA4-87B4-2F64180401F0}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{71024AE4-039E-4CA4-87B4-2F64180401F0}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{79043ED0-7ED1-4227-A5E5-04C5594D21F7}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-007E-0000-1000-0000000FF1CE}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0000-1000-0000000FF1CE}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90160000-008C-0409-1000-0000000FF1CE}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9F51D16B-42E8-4A4A-8228-75045541A2AE}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D46F1FD9-2FE8-4D05-B2AC-011C23B69B24}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D46F1FD9-2FE8-4D05-B2AC-011C23B69B24}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}""

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E634F316-BEB6-4FB3-A612-F7102F576165}"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\QnuiKuswdoTS_tezmp.ps1""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\QnuiKuswdoTS_tezmp.ps1"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "mullvad account get"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell -command "function Get-AntiVirusProduct { [CmdletBinding()] param ( [parameter(ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] [Alias('name')] $computername=$env:computername ) $AntiVirusProducts = Get-WmiObject -Namespace "root\\SecurityCenter2" -Class AntiVirusProduct -ComputerName $computername $ret = @() foreach ($AntiVirusProduct in $AntiVirusProducts) { switch ($AntiVirusProduct.productState) { "262144" { $defstatus = "Up to date"; $rtstatus = "Disabled" } "262160" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "266240" { $defstatus = "Up to date"; $rtstatus = "Enabled" } "266256" { $defstatus = "Out of date"; $rtstatus = "Enabled" } "393216" { $defstatus = "Up to date"; $rtstatus = "Disabled" } "393232" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "393488" { $defstatus = "Out of date"; $rtstatus = "Disabled" } "397312" { $defstatus = "Up to date"; $rtstatus = "Enabled" } "397328" { $defstatus = "Out of date"; $rtstatus = "Enabled" } "397584" { $defstatus = "Out of date"; $rtstatus = "Enabled" } default { $defstatus = "Unknown"; $rtstatus = "Unknown" } } $ht = @{} $ht.Computername = $computername $ht.Name = $AntiVirusProduct.displayName $ht.'Product GUID' = $AntiVirusProduct.instanceGuid $ht.'Product Executable' = $AntiVirusProduct.pathToSignedProductExe $ht.'Reporting Exe' = $AntiVirusProduct.pathToSignedReportingExe $ht.'Definition Status' = $defstatus $ht.'Real-time Protection Status' = $rtstatus # Créez un nouvel objet pour chaque ordinateur $ret += New-Object -TypeName PSObject -Property $ht } Return $ret } Get-AntiVirusProduct ""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -command "function Get-AntiVirusProduct {

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupm8vObU /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe /f"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupm8vObU /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\" /F /rl highest"

C:\Windows\system32\cmd.exe

cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupm8vObU /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\" /F /rl highest

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDriverSetupm8vObU /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe /f

C:\Windows\system32\schtasks.exe

schtasks /create /sc onlogon /tn WindowsDriverSetupm8vObU /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\" /F /rl highest

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\"""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "attrib +h +s \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe\""

C:\Windows\system32\attrib.exe

"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\arthe.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell -command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\arthe.exe' $Trigger = New-ScheduledTaskTrigger -Daily -At '12:00PM' Register-ScheduledTask -Action $Action -Trigger $Trigger -TaskName StartCacaTask ""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -command "

Network

Country Destination Domain Proto
US 8.8.8.8:53 nova-screen-webview.com udp
US 104.21.59.75:443 nova-screen-webview.com tcp
US 104.21.59.75:443 nova-screen-webview.com tcp
US 104.21.59.75:443 nova-screen-webview.com tcp
US 104.21.59.75:443 nova-screen-webview.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
IT 185.196.9.89:443 nova-sentinel.com tcp
FR 51.178.66.33:443 api.gofile.io tcp
FR 45.112.123.227:443 store1.gofile.io tcp
IT 185.196.9.97:443 ieatpoop.info tcp
IT 185.196.9.97:443 ieatpoop.info tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
IT 185.196.9.97:443 ieatpoop.info tcp
IT 185.196.9.97:443 ieatpoop.info tcp
IT 185.196.9.97:443 ieatpoop.info tcp
IT 185.196.9.97:443 ieatpoop.info tcp
GB 20.26.156.215:443 github.com tcp
IT 185.196.9.89:443 nova-sentinel.com tcp
US 8.8.8.8:53 97.9.196.185.in-addr.arpa udp
FR 51.178.66.33:443 api.gofile.io tcp
US 206.168.191.31:443 store8.gofile.io tcp
IT 185.196.9.97:443 ieatpoop.info tcp

Files

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\chrome_100_percent.pak

MD5 a0e681fdd4613e0fff6fb8bf33a00ef1
SHA1 6789bacfe0b244ab6872bd3acc1e92030276011e
SHA256 86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2
SHA512 6f6a1a8bfe3d33f3fa5f6134dac7cd8c017e38e5e2a75a93a958addbb17a601c5707d99a2af67e52c0a3d5206142209703701cd3fab44e0323a4553caee86196

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\chrome_200_percent.pak

MD5 c37bd7a6b677a37313b7ecc4ff01b6f5
SHA1 79db970c44347bd3566cefb6cabd1995e8e173df
SHA256 8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a
SHA512 a7b07133fa05593b102a0e5e5788b29488cb74656c5ee25de897c2ba2b2a7b05c0663ade74a003f7d6df2134d0b75f0ad25e15e9c9e0969e9453b7fc40b9f8bb

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\d3dcompiler_47.dll

MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\ffmpeg.dll

MD5 eda70f75c18fbc423f32d696e88ff302
SHA1 62d27cdfc9a0753b95501da75b6d81796ff70b2d
SHA256 eb015f75cd2e9025eb59a0f0f0d6d8cc397d96315dce6651cf7d8c42ab2f817a
SHA512 6245989e981a672bf04c4fac044fd128951ed75e972162d974027b49159abc8fb4398758de507d84689bf414029cea7637030f787ebfbeeba90f3b2839aec297

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\icudtl.dat

MD5 e0f1ad85c0933ecce2e003a2c59ae726
SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\libEGL.dll

MD5 3bec18862b4d150f18262dd13b17dd1a
SHA1 93384dd4e9602401f745c78815c6c36a5c94aef3
SHA256 03d8026e81f5ce02d663076d0703fa0b1c9cb53c246cdff5ffa8c99354e4589b
SHA512 c7b66a243256476bfc467b0a8171e707425b7da21b6beaaaca954b4ccb1eb8249b27c01e46a483af99ef2197beb88e006f8c6c4e65cc7acf39c603098468df12

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\libGLESv2.dll

MD5 22ef6d8f6b688e4f23739fc41a809b95
SHA1 0bda3ce05b756faaf5af9158206a7a6d3f2926a1
SHA256 17c4857fd36cb143331ce1402c8bb394a25c8beca48c5abe0616dcea6a4d19a8
SHA512 4743c16ffb3c18a950747c728082937ed30e6dcdc1afca0bad0f74eef0f47c42b02bb3dd48bb66ad2fdee041fdb71603c5500ed351f7c16e7622bb01bc4c2ffe

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\LICENSES.chromium.html

MD5 2675b30d524b6c79b6cee41af86fc619
SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\resources.pak

MD5 e2088909e43552ad3e9cce053740185d
SHA1 24b23dd4cad49340d88b9cb34e54c3ca0eb0d27f
SHA256 bba36d4d18d64d9627f54c54fd645c5ba459d25a59acc5228210bd707aef67fd
SHA512 dcefacddec38d8941c7d2d7b971b6f22dd0acb4116e48891d1d48a4d88968da12b152ccb7591715c88f8e14c315e235d1c4e6852cc38b9246091c50226900de6

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\snapshot_blob.bin

MD5 6fcb8a6c21a7e76a7be2dc237b64916f
SHA1 893ef10567f7705144f407a6493a96ab341c7ccf
SHA256 2bceef4822ca7cc3add4a9dcb67c51efb51c656fce96a3b840250de15379959c
SHA512 3b745740bbbe339542ef03fd15dd631fb775e6bf8ca54d6d2b9cead3aa5aafc4cab49e507bc93641e581412bbeb916a53608d5f5d971ea453779e72d2294dafb

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\vk_swiftshader.dll

MD5 6462f53038234de8fef3e6fa31bb46d7
SHA1 8f610b8bf9ef943411c50b5d7862d616d2232b03
SHA256 95f6581afe35f4a89fad311fd8b49c3677b27233a9d0972da18593a4dbb94d14
SHA512 475bbd91b16311b2e24db67dd0ff4682730aef9e1a99d4dc9e5ac2734582f10a1671e383820a069255b5250bdeb76681268ceb049b9a8130d6de9db704d043b1

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\vulkan-1.dll

MD5 179c11146cb6a58d8fd631da7f5480ed
SHA1 47652ed572cafa61ae71bc45d65e77cebe0822ca
SHA256 43e4f96e6306d584f2cc4b29e56a24731ebf5471459faa8fa983ce8472087263
SHA512 184c056e20654f9d559c261526bd98805f4b4b8ae52a2e803777f58704414a3cfa7495c7bf0fc4d9e90356398faef03b42da91b7ef443a784bff86e1093d3910

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\bn.pak

MD5 d43ce80ddca3fab513431fa29be2e60a
SHA1 3e82282e4acfec5f0aca4672161d2f976f284a0c
SHA256 87670ff2ceb1ebc38fce2c3b745ac965f3de5de3133d99ed33933a8f3e99d874
SHA512 1d33ca9bacb91ef328f89a14777a704000bf30fe59aa1cbbbff34d8bad266c98d78c9e411e289e834e76eb721dd98934426a565cd5b3436d5a103abe37f7612a

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\hi.pak

MD5 9e1788b0f3e330baf2b9356a6c853b20
SHA1 a2f4b37a418669e2b90159c8f835f840026128d9
SHA256 c640313e10e985a58d16f928d2428ae278421a070d948733ac68fdf7312090fd
SHA512 b9a577e084f8daeb53fad0a9423661c99cab272125899a16b0b052606a2cb88f823137f3a21b5c06b10e0235321b7faca84cd759bf406fb2dd02c2f598e92cb5

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\he.pak

MD5 d8320b09c1e138b00655db0802687bca
SHA1 01616bda6b22c70d5c6440b7451ae736eb1336cb
SHA256 e3336668aad9ad661e7f589f1a405b9c95fc771261cdf9328aca88f4be763374
SHA512 5a91596d7e82dc3d692083ae45aff6fdbddd08ca17f49a020e0769f98c4218b6c9cd31e54524473b7cdccbebf4d7a7f0ff23b5075a1e1ada5cc35c3fd0172bed

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\gu.pak

MD5 225167dbdf1d16b3fafc506eb63f6d1d
SHA1 8651b77f41e3c5b019ccb124a7c8f6449a04b96c
SHA256 ff379dd77136b9b85e7e9fcb5b261ace9c6d9184af3ba2dea35b1757b9bab6d9
SHA512 a353d36a87b6608578816056647de45a456f9012d399b2cb5cb7b9de867a370fcaf1a90d293f367b9b678d13991294425abd85cf77e971afa0d3e9c316952115

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\fr.pak

MD5 d8b4bc789a0c865fb0981611fb5dcdbc
SHA1 33f9f03117f0bba56a696f2fa089ba893ee951a2
SHA256 52aa0a18ace6347b06a89e3851a1b116812c022dbe41da8942278878b5409cee
SHA512 58d19e5a3c68c901fa2a0c327a45b410ab9b9e6c39298db48eed25345453dce1a4633afe6277cf53ed558e160065b89c0e38a32caeced47e79783dbda4d74f26

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\fil.pak

MD5 7354de570c8132723c8e57c4ccb4e7c4
SHA1 177780faf460e3c8a643a4d71c7a4621345a8715
SHA256 91149190c856195fb330605686acf09c7197e5b7efe37fe2a7c76bb8fb08cc89
SHA512 a8487a6a7fd46d62e78ca4262de49e12c120268561ee61a642c45efa48116edebeb40cf9e8be229db0bbf06bb6b5457cc54399a08ee6a603e5540ef5ca482798

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\fi.pak

MD5 fe011231bbc8b3a74652f6a38f85bc88
SHA1 2b851e46738d466b3a5a470de114d15051b6eb6b
SHA256 7a3249514585491eb47fe4b579edc27ccc48761e7ad6bc11d113b257132c5dd2
SHA512 2a4e5c1409347b4b514556c81ef32c8ae118add28e3469717b13045c8424fed9b817c7988629050ed3e732e0cdca181891b6a8b9e64e4c8d65f004d7c8db9796

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\hr.pak

MD5 af7aec4b45ead620463b732e16f63e47
SHA1 e6838c56b945c936fdb87389fdc80cdf7bc73872
SHA256 bfeeafe2f8a9f797d20c4209181c4768fbea4a61ff2dc1f57f6cd18bc872fc13
SHA512 784ff8dc6011883e931b4b8371e5ada960120931bfdf24f81648f5092fa31db1d03e5d3cf5cd16d57ea7fb7877bb25a28533085ab42bfe40dc25ca7d9cee7ade

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\ja.pak

MD5 dee9626a8d7cacc7e29cff65a6f4d9c3
SHA1 5c960312f873ab7002ed1cce4afdb5e36621a3ce
SHA256 63ad3974baa8c160ba30448171f148d008ac19e80010fb13d3a65cf411b67ae0
SHA512 ee80d58886f4ac378d6491e075062c171a715af7c42dd1785952b25a572381acd722764e8be914adbfccf2a5fa4a51968b989b632eefb9d636851f1b8ffb82e1

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\tr.pak

MD5 55e06cd9356d0fb6f99932c2913afc92
SHA1 aa5c532ddb3f80d2f180ad62ce38351e519a5e45
SHA256 afcbf02420dc724059f70d1dc6ffa51f5dd75136d9e1e8671d92d5d14955edf9
SHA512 813c180cb1aa205034497be5fc8a631ff117e5ed17cdf0ac59b7569d74d849b385852a15bbadd3146f942c58bab80d94bf0980d13ca4b4424d1cb1df0cb1a2cd

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\th.pak

MD5 4917873d8118906bdc08f31afb1ea078
SHA1 49440a3b156d7703533367f8f13f66ec166db6e9
SHA256 d051b400096922089f6daa723fac18c9640ba203b2879aac4ca89b05738dd32d
SHA512 30e6446bad54b86be553fa293c7a92ec221adb54b99624ed69702df75347a98697158041a45f77ece4e7ed0fda41306ef21eb27981f24f0a4e42e8306175a88e

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\te.pak

MD5 17b858cf23a206b5822f8b839d7c1ea3
SHA1 115220668f153b36254951e9aa4ef0aa2be1ffc4
SHA256 d6180484b51aacbf59419e3a9b475a4419fb7d195aea7c3d58339f0f072c1457
SHA512 7b919a5b451ec2ba15d377e4a3a6f99d63268e9be2865d674505584eed4fa190eaae589c9592276b996b7ce2fdfae80fda20feff9ea9adbb586308dfd7f12c2a

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\ta.pak

MD5 5f80c9da0c09491c70123581a41f6dad
SHA1 3fc9560a954271cf09aaa54eec34963c72c06e85
SHA256 30658d99d753946e9c9c02094c89be25b710db77251df6cd1a8839c29de5f884
SHA512 072c5db7fe1eb9e6c270d0e9b439cf84ebb3dc374d4f01f01f9341030883f2d6d9c6970fb6ef14bf96fccb51eade9ca762f396f89ba1d3df1230dda68557fd4a

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\sw.pak

MD5 59ff4e16b640ef41100243857efdd009
SHA1 f712b2d39618ffadcf68d1f2ab5a76da5be14d74
SHA256 c18a209f8ec3641c90ea8ced5343f943f034e09c8e75466e24dcabc070d08804
SHA512 0e721a6cbf209ac35272ad292b2e5000d4e690062ddb498dbf6e8e6ee5f6e86d034a7303a46c2b85750245381c78efafc416ead13c1fe0ee5ec6088dd66adca2

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\sv.pak

MD5 e4c9ced1a36ea7b71634e4df9618804f
SHA1 c966c8eb9763a9147854989ea443c6be0634db27
SHA256 e5cccdb241938f4a6b9af5a245abe0e0218c72e08a73db3ed0452c6ddfb9c379
SHA512 d07a4d62f22a1830d3ec44f0c347e4a7d70b35ceba126cbdc246a7b3ee7eda85e2338bab3edc7223f579964868136bb10d42c05e0e0ff9f73447b3606d9b2c4e

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\sr.pak

MD5 8f58b2463e8240ef62e651685e1f17d8
SHA1 6c9f302aed807a67f6b93bcb79577397a5ad3cf7
SHA256 5a55320d6953efb5b565893e32e01f6dae781a16460df5502c8ba012c893edfd
SHA512 6076d43a73d5fa5192cbe597e018b268cfdc7efb94a6cb45dad5b0da9c3abf68aaf2ea06f3ad650b28a993605917b6d356339d79f8dd6962d2c40dbf4653ef83

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\sl.pak

MD5 435a2a5214f9b56dfadd5a6267041bd3
SHA1 36bbc7ca3d998bfb1edc2ff8a3635553f96ca570
SHA256 341c33514c627501026c3e5b9620cf0d9f482ab66b10a7e0fb112c7620b15600
SHA512 55271935e18ac27c753431af86a7dcd1f4a768adef1b593ba8e218da34856a5f9faf9819a3ecce3f21f0607ba95100c5cb18cd1a7138ec563090d0391ad5b52d

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\sk.pak

MD5 f117e58e6eb53da1dbfa4c04a798e96f
SHA1 e98cee0a94a9494c0cfc639bb9e42a4602c23236
SHA256 b46db20eeba11f8365296b54469fdd001579852dc1d49a01fc59d2a8bcf880a3
SHA512 dea792a63e0557d9e868c0310ec2a68b713daf5cf926389e05a0885cdb05433d20f35d087de269f9584795da50600966b8ff5dd95583861443a1e90564a89793

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\ru.pak

MD5 1a9b38ec75ccfa3214bef411a1ae0502
SHA1 de81af03fff427dfc5ffe548f27ed02acae3402d
SHA256 533f9e4af2dce2a6e049ac0eb6e2dbf0afe4b6f635236520aee2e4fa3176e995
SHA512 05cf20aea71cdd077b0fa5f835812809ad22c3dbebc69e38ab2c9a26ad694ab50d6985aec61633b99713e7f57408c1c64ce2fb9ccdac26661b7167853bdd6148

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\ro.pak

MD5 4e692489e2ae74a4a11ca0a113048f15
SHA1 cb2b80217d5372242d656ac015c024fe1e5e77b7
SHA256 4a2a305668f1926cfe4bb72e8fbfde747c83ac4dd9cf535c13ae642d0b96fb79
SHA512 8ad9e0a79137a862def24d6963536e75b87bb71ab74dbdd43531c5c95ddd3cd834f22c6a8e3a1e03aad35ade65ecd227d5101b5be3ce3f0b7b471f5136cfd77c

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\pt-PT.pak

MD5 0237374730fa1a92dec60c206d7df283
SHA1 62dbbd855d83ef982a15c647b5608dafb748745a
SHA256 2fb2fd2e32b952dcbc8914f9d3aaf02bf2750b72abfee2e8b2bb08062ddd9934
SHA512 63ec4ec44002724e22703a3bd952d1ff4062b367c4f5e3f106349bd226ad1317bef2e371fda0e099ea5c0afd32a9d2c1246c93c18d73dccf8fc2c1644a6fb6b2

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\pt-BR.pak

MD5 53d5fb849c9bab70878b3e01bffad65a
SHA1 e72af1a76539e66cef4a4eef5844b067a4e1a79f
SHA256 40dd24c5e225ed941bbaab3dcfefa993e39fbc75a1798f4f6e06424956698ac5
SHA512 55357643d789d2eed72e009f08f72ba4895ba455ca00c8347a3c3790e43f8d7e4625feda438ecac840bdc52c26d2135d89bea693b61a293922b6056bde6b4516

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\pl.pak

MD5 ba7a9aba68211d8639dffae0ef8b88da
SHA1 a9a26b8f0902475cb576967cbe9013028cb21da4
SHA256 60aa08598a81bb46ddc64a5ab0852565554c6e6262e9c5dfee09f4e3fc08d5fe
SHA512 a1b8bfc3e19aa1267e31838e1c1f2b0b1cfcdf56f84e967088d626b58ec64b3305043a14b12fd080498ee1d74a4192453914c393ce8f848ea5616cf88abc4eb5

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\nl.pak

MD5 7fc6ae561fd7c39ff8ba67f3dbaa6481
SHA1 2e3977403a204c6f0ca9a6856bb1734490a57e72
SHA256 844031e1de2b2872d12d5b7d42adf633c9d4b48169b1b33b7492b3b060c73558
SHA512 90294ae24b7db003bc34a48f98d9e1887e87c6f605defe01ddcf9187429e8446c04a7f94bb6aadc8e61c98842163bc3702b414393ab836eb0bee038f09481c2b

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\nb.pak

MD5 28cc86c7204b14d080f661a388e7f2c0
SHA1 e0927ea3c4fd6875dafd7946affb74ad2db400f5
SHA256 9253122d94ccea904fb9363b8178ca9335b8380b7891f1a7a22afb3113309e72
SHA512 e2524e10d145f95c028d65e47cf06fc82c7a43fcf0ecf01202278c7fb14079c03e9434e8039fd96aaee870872c9896d9f0ed575e50c19a3781cb0c94fe59b3a5

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\ms.pak

MD5 73096184d7bd6a9a2a27202d30a3cfa1
SHA1 ea711b29787aa8b9e9af6bde5b74103429e5855f
SHA256 d1072514bab63af5dfbf923175d491787139f0c1b6361acb23e67543836c84ba
SHA512 e3fbee4896554e502c222b5ffe38e9d61e9db4d18cdc92ce5118b819dc60789bfd6d6c7f8444ff1763222455ab91e79bfe500e75c0e06b0de70c2c64fb043c6f

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\mr.pak

MD5 fda40999c6a1b435a1490f5edca57ccd
SHA1 41103b2182281df2e7c04a3fff23ec6a416d6aa9
SHA256 0ebb125a0bdfd1e21b79914ca8e279790d41f7bac35bf2d031dd7981f1c1c056
SHA512 666ceb24d2e568a00a77512295e224a6545bf6abcfa19c93aa823db5330117fcb39fde570e7601dbd41976950c3ec03634f89fc5d9203357515e6651ab0b6d32

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\ml.pak

MD5 6e96eddfe80da6aaa87f677feef4d1d6
SHA1 8a998785d56bc32b15cee97b172cd2dcdc8508d9
SHA256 e2fb73353ab05eb78f9845bdbdf50b64c9fb776b7f08948f976fe64e683397c4
SHA512 feea11dfc6ec153ab903b5828306617eedeee19daa73bd046ae47757795fecb9abce6192bb3a9561aaace7fc85ee442057b93081c6c986855b819fd38815e6f7

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\lv.pak

MD5 e75cdda386dd3131e4cffb13883cda5f
SHA1 20e084cb324e03fd0540fff493b7ecc5624087e9
SHA256 ae782f1e53201079ca555baa5ec04b163188e5161242d185f04a606a49fc8c0d
SHA512 d27bc61028031946ed6708918f921c3d681c8962b8d5507a91ab6576e3b2c462524e550305db87ede886e41fb0e49edec2d84cdbbad675282105627e01d98bf5

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\lt.pak

MD5 3e9119a712530a825bca226ec54dba45
SHA1 10f1b6bf2fa3a1b5af894d51b4eb47296c0dbc36
SHA256 3da531a9a5870315823e74b23031cb81379d2d94ae9894a7fb1d8a8ad51a2da9
SHA512 765c872cafa1b266575b0cac09dfa796cdb860bd82e1c657397fe2aada11771f306b0a1776e4d66ff41e94b153c812592430f31e7b1ff97abe7d8e6b96d321f1

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\ko.pak

MD5 38a95d783d627e9a83ad636faa33c518
SHA1 cb57e8e9ef30eb2b0e47453d5ec4f29cea872710
SHA256 0d9b23e2981412d11ecea3ade8d521a073802d9431c39d72b88f62b98e50a96b
SHA512 4119b8f82107473c941c9e10b6bae97d60c9c47570cc2b40f429a95f4f5cca77eecbacd7023af439429026f6e55ad9df19998c8b98be0d04d384b310d025c0dc

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\kn.pak

MD5 32e5f528c6cee9de5b76957735ae3563
SHA1 74a86191762739d7184b08d27f716cfa30823a98
SHA256 cd297f7e872b34e63ca2d98dc2fa79085e8a2985ba8757601e4b901a3f30b013
SHA512 92d100b1289e63fd0dc65657fb4b1e16f298735e6cd066e9122d04e3b79e0d286f15fc9f1da2c3a05af528b92bde95fcfbc493c466db2d94a0749adfbf7fb8d5

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\it.pak

MD5 ab160b6e8bbaba8f8bde7e2d996f4f2e
SHA1 eb7eae28a693337b8504e3e6363087b3b113bc72
SHA256 e86ba661b3f6f7ecd2312fe90b873330c0d6516a5501a0f326875844e8d4b289
SHA512 14e8919e2f5a7ad2b3f310ffec590b221e6e0dc45f37efc57ff9b8ff7a3ca674d6f4b9bd65e49a98af6726fa953f2168e5c8e6101ed977e8c7ff4a51203f8d4d

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\id.pak

MD5 bc719b483f20e9a0b4b88969941c869d
SHA1 4d926a9aba7c350e9da8aa570a9f52534c81aa88
SHA256 f175e58be47b228803aa32d2695e2fcfaf4655b65b96fb6b539b3e59593e6799
SHA512 ddf6108888676c1a90865daaa88198b681b685d9047b0e10f5aa08daa39a628a84732a8518606176529297bec51ce8bc39e910eeffc8b88e9585fafb694c35db

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\hu.pak

MD5 b93beeb1e35a29b310500fa59983f751
SHA1 45c0b2cab4c4a820cfc2aed4b7236ddc79a0db00
SHA256 bab09c3cb80130a4a288642633c2b31ab08b1757466d9a468bc36d276079f002
SHA512 249de5b8bd7c4755caa8b9552254d353b0d885b63bd5f7c6c8e29b3f4e447c9e8d6c0e88d5aaba0b898aa26880592b3904e19ca4797a2ac1dd757aaee782c37c

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\fa.pak

MD5 c770cfb9fbabda049eb2d87275071b54
SHA1 20e41b1802c82d15d41fadaf3dcd049b57891131
SHA256 dae7e7c87026cd4e8a4cd813cc71def32c86ed47865ce6da5383b66b7021c5bc
SHA512 cda117a60c853f12ade579c34fce22d992b33df1f5001a237767b6e642d5c775c3387bcee05d6557fe5a2f6235f93258954a697d3b9812d2550c4801869f4751

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\et.pak

MD5 82a07b154cb241a2ebe83b0d919c89e9
SHA1 f7ece3a3da2dfb8886e334419e438681bfce36cf
SHA256 84866ccaf2ec39486f78e22886bef3fe75c1eb36e7a7c071471040e12018db28
SHA512 07319d155bdf9e27762ecb9ef6871430bef88b1af129450eb65aa798ebaa4e02b25b0cf9bde3b12ff1b04a3d14241569b73d6af895d2e85dd7b24d393e7317e9

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\es.pak

MD5 a24e01a4947d22ce1a6aca34b6f2a649
SHA1 750c2550465c7d0d7d1d63ad045b811b4a26dc55
SHA256 848d422be1b8fae74786ed6d6dfa7dd2e97b798b4a9ba1d929085e425b2a54e0
SHA512 02fc4ce96aa523ebc204243bbec3347b09cb20bcc0ba66cf9532a6fb26c48f7f2396bbb833f1916f8f081ffc9c6cd2de07315e66c5115042a0b44270fa4468c1

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\es-419.pak

MD5 6f4613a4a88af6c8bd4ef39edeee3747
SHA1 c8850a276d390df234258d8de8c6df79240c8669
SHA256 8f7b8776e61e3ed5aa33b1a571ac834653b54b12a499d956b95d567b7e1ba987
SHA512 e5933dcb2aaaa2018ba8b13f4af3dc8a950640ac60acb1b56ad6de24541701d0ffc1f4cb28c7932af924bfd673edcee20bf649156ab95ea9499ec43c703ea141

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\en-US.pak

MD5 626f30cfd9ad7b7c628c6a859e4013bd
SHA1 02e9a759c745a984b5f39223fab5be9b5ec3d5a7
SHA256 0fd74bb69ad35b3f9391fa760bf0eb0ee73d2bea0066244577ef2abd269513de
SHA512 9ce902f21fef70c5b5af444b532b36c9a00d896878cb4021c9b1dc07aa3277d956bca65ee0adb68467eec113e535b60a8a5fb5414c7d0ca761ceae5c43b7d9a9

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\en-GB.pak

MD5 9d9121bdc9af59b5899ce3c5927b55d8
SHA1 568626a374cd30237c55b72c74b708da8d065ec1
SHA256 f4d45ccc89834376f35d4d83fe5b2d5112b8cc315fcb03228720749aae31c805
SHA512 149a8acf256dc12f62706f72ad8ec88cbfdf7f8dc874bcd9facf484cdb00e7c5787f5e1bbc12b5bbe1b19b6524e7e8a1c7dba2838abeb9aafa3ce89795fd22ae

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\el.pak

MD5 a14d8a4499a8b2f2f5908d93e2065bf7
SHA1 1473a352832d9a71c97a003127e3e78613c72a17
SHA256 eb46d9860835b69d33b2583d1e52b20238b666b967bf00906424e3c8a161ed64
SHA512 427271d12590f8ea3f11b83e4c0ce79c55c289573c5f6e5c70c789b28a5181f295a3c9b1a4bdd1f731f338e6edb1e06318ea6410ceac546128a84ff8f2ec0b40

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\de.pak

MD5 2163820cd081fdd711b9230dc9284297
SHA1 c76cc7b440156e3a59caa17c704d9d327f9f1886
SHA256 6d787033c94755cc80c187ed8a9de65808bb4d7968354bbb94b7868ac2e8d205
SHA512 920fa2a10f7aa7f1f6d911fe2a77eded0384617d8fd863943afd99a584dab3fb2ea3e5d2e20bca529689a99fdf303912007f2918c62482d8a90194a810f6e535

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\da.pak

MD5 1939faa4f66e903eac58f2564eeb910e
SHA1 bace65ee6c278d01ccf936e227e403c4dff2682d
SHA256 0b9da7bd6531a7ebe7d8188b320c0953adcfbaf654037f8265261a12e63d3c87
SHA512 51588d2fe724e6c407724ea6f46883ded39397af744effaf672f75952a6a734e61e93e59f446080317f2a2b3fa1b45e7405f90fe0b226c44c9f3dd9a4e130a87

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\cs.pak

MD5 06e3fe72fdc73291e8cf6a44eb68b086
SHA1 0bb3b3cf839575b2794d7d781a763751fe70d126
SHA256 397134d1834f395f1c467a75d84ef2e8545cb0f81e94dbe78b841fbbdaad802d
SHA512 211594c30ad4f5ca8813596b59751168c60dfa0d13f24f2aa608fce82d21c2de3de69fe007c4bde1602da8aa7ea81ec0f15e173abc1224362c36b493b425b425

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\ca.pak

MD5 2d30c5a004715bc8cd54c2e21c5f7953
SHA1 fed917145a03d037a32abac6edc48c76a4035993
SHA256 d9c45d55a9a5661063b9bbebb0615de8f567f3925d04fd10938da9617c6220e0
SHA512 b3803551f53d290d8839789f829afc9c1e12052c81ba20d5e01fb3d2bacd5d1e97bd4c05074322eed17fdec04c9176c655076faec8a3aef17c39fb999e0c1fcf

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\bg.pak

MD5 a69f6075863d47b564a2feb655a2946f
SHA1 062232499ff73d39724c05c0df121ecd252b8a31
SHA256 a5eb7038ed956bad7704a722f05691474ff709dffbad92b8e31dbb869ad58334
SHA512 930ce3938aa02a8bcc609a64bd86b7e6164d63baad157a980fd079859a6bee5db87bd1f7a74a71108f8368bc9c6154bf14a2dba1abf269f572bc262614bcf1db

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\ar.pak

MD5 3c2ab7363018db1f20b90acbc305cb4c
SHA1 60b9cf453178ad0e60faf20d137a0c7eabde65c9
SHA256 3ca47b9c436723f837a53b2904b51efdf13ab6cad2f3ef4fe48a1115847eccbf
SHA512 589beb3e95e93f30341933c9b9826210e6bf3e9c1ad8f113d9d8a98fa5a526f81e454ee3357fb55d60d67a4890ce33e964ba2fa810e1771a6b7e82746492313a

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\am.pak

MD5 3cfd7c5bb92ab72c63e003208a9e4529
SHA1 165d2f69ab6a6e237f0fec943b5577123cefea87
SHA256 12e9e1bec1c46e5ea706157726e17a4429acf288a5754fa183bd9b4cf7d3853b
SHA512 cd7c7837d758ea66abc871503cda6fe99ff45990405e60c1133e7c1f4cb29ee69723c9558bb2d3eccb42948da57351f4f095062616686ab2e255acd3c86236f0

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\af.pak

MD5 917a688d64eccf67fef5a5eb0908b6d4
SHA1 7206b01bbc3fd8cc937db9050dd8ac86cf44d8cc
SHA256 6981249837ad767fc030edc8838878a5e493fb08cc49982cffaed16cfbeb564d
SHA512 195dbec8463cf89990232296c5c927e1501f0c2e01a7be7c6a6acae651853ce1edb23d639af65979b39a3c61979119c3a305acfa3aadf0cb93e241c5e57f4534

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\v8_context_snapshot.bin

MD5 1a37f6614ff8799b1c063bc83c157cc3
SHA1 8238b9295e1dde9de0d6fd20578e82703131a228
SHA256 4fbe07f71b706c2a2948eba9a6b1979e23c83342b190723a6ec5251b2d6dad7c
SHA512 6677f65a0e26fdc2cff6cef0231f5e5f0713ee7c5cf7f488599a3c7ac3e8365afaec10b35d6145ea58d364151d8bcb08308765693a9797ea99b894d6e8224ac7

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\zh-TW.pak

MD5 f466116c7ce4962fe674383d543c87f6
SHA1 f65bf0dc1f1b15c132674fb8ff540f7d2afe1d6e
SHA256 ff3a294fd1afb1fa7aaf53fbc4396643a12ed132633c5c86f14c16b88fa94a7b
SHA512 4851a08069fcac75e4051e53d4526789bfe6c393ab963e8263803bbf6e96cb150e9ba741650efb5ee500e8a757d8512eb17dc268cec1ab6fd3acfac62f7da27d

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\zh-CN.pak

MD5 3210460a24f2e2a2edd15d6f43abbe5f
SHA1 608ff156286708ed94b7ae90c73568d6042e2dbd
SHA256 0f8d42d7f0b0b01aafad6ae79f0bd0ca518b2db94287b09df088bc093f15f605
SHA512 f97427dba4217e01a7ed395c453d03dda4f2258cba589258da0eacfde427bf442cddef541a23e7782914433e70a9623e904a5070deba9f9d50dda20732eb5e86

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\vi.pak

MD5 4076d3c0c0e5f31cf883198c980d1727
SHA1 db51b746216ea68803c98d7c1a5a2b45944359f3
SHA256 f1458c4ce4ca708e849eb0c68a5157360ef003f3a9c95628d5ca12ada303b379
SHA512 80e4e960218f7d84423124c34352251411baf008e821a344a0b6c2e7f1483694010f28b7de21c7e2c69abb4ec92e0d9cbddeed6279b90c47245f4cbc500cdb77

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\ur.pak

MD5 861ffd74ae5b392d578b3f3004c94ce3
SHA1 8a4a05317a0f11d9d216b3e53e58475c301d7ea5
SHA256 b9f22a23368bf1e21f3085583ecb775cce8045176721ff6ae798b06bd2810dbc
SHA512 52ede35b7ed1fb6e51b18e450b95c3245d326f2afda646e3642ee68b714dcf9a726afe32e2759e9ea87a104f4a59e6fc2c60b3275aad8332ae1c626231e6747b

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\locales\uk.pak

MD5 381cb33c2d4fd0225c5c14447e6a84e0
SHA1 686b888228f6dd95ade94fee62eb1d75f3e0fc93
SHA256 c2a6b16abeab6e18276bc1636555e93218763b9c99cacd0b42481b35e3a11820
SHA512 f7a2828aa4cd85f07a5d66832f247f70951abf34f81a282dc41ec51875ba70d940353d010b605c56cc59bee47309aa311099d4e6ebd17f3c1538521d0cddf4b6

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nsd67B4.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\0263c8ba-60f4-4308-8cfd-9c1f0f3edf6e.tmp.node

MD5 d6c776d3e3d45398909b8089339cffed
SHA1 1273ed2ed41e60d5829acb44bdf3b944be9ba4c5
SHA256 edce4206cca72b8358ba58e757cd312d2b9226845bc6f19f8f1ea9692a4dae93
SHA512 34124efe5f1ba8b7f49cff1105d4e3e3c71354e1099952a7300fb84c62b178ebd32545ca4f03fa8f7c903f1f6ae18980c6146cba25bc2e92674a9c42bcd93965

C:\Users\Admin\AppData\Local\Temp\1f944953-0ece-4f3b-b68c-fa3c755949bc.tmp.node

MD5 56192831a7f808874207ba593f464415
SHA1 e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA256 6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512 c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

C:\Users\Admin\AppData\Local\Temp\b4c9bc22-893e-4198-b886-36fe5b98f25c.tmp.node

MD5 6dc80629358026270df0694074b8a18f
SHA1 49e0e9ec3c1aace0cb84b9f1f0fffa060ab31036
SHA256 9a19f419905559e6ca56e81937e273984b2f110103890ca761043cae71133a9e
SHA512 4804a5423a720b2e8ceab41c48cdddfa529d8cfff100de5a2810f20a016f33ffdd6732f39349428cd62fcf067ea0957bbecddc11b8462bad06c0f92055654a22

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vgxtqxzx.uke.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2924-582-0x000001FF63040000-0x000001FF63062000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 235a8eb126d835efb2e253459ab8b089
SHA1 293fbf68e6726a5a230c3a42624c01899e35a89f
SHA256 5ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686
SHA512 a83d17203b581491e47d65131e1efc8060ff04d1852e3415fc0a341c6a9691ef9f4cf4dd29d2f6d0032a49f2ba4bd36c35b3f472f0ce5f78f4bb139124760e92

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

C:\Users\Admin\AppData\Local\Temp\QnuiKuswdoTS_tezmp.ps1

MD5 9963c595eb1f31cbe3c1e32797b013cc
SHA1 26c8c90e5b13d5f26b1fdcbc7a09cec1506d191a
SHA256 1d7a9a092cefcce2aa3e9b06e9bc6109a57a7ff212e072a1aaa7aae942bdddd0
SHA512 e37a6afe2a33b8cf13d4d025df0c2c57d43d3317defed927e71a20aec229a0e9637eb22ad9d0e953594827b61b31de0f201989f3ce531563cb60b893cce27b85

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6e5843696d70df783161968b9f9e1759
SHA1 6e7ab4a749b553ff66e8914563ca9f98cabe3ecd
SHA256 51f80b81fae4ad9aa2b195b561274799f4bab0b9c12b0b86748044f12bbab719
SHA512 5b44b40619c0467fc41009a5ca7638ae3ab948757c4707b8439c7485635d9cfb120406d76e330b0993f17f63739a7d8d40e3ae71574a89428501ab63a44e9093

C:\Users\Admin\AppData\Local\Temp\p8RbAWEoeFDJiyO3lGFD\System\UOECDFVI - 2024-06-26_221525.png

MD5 bd174b76d156185f206d8b316d28bde3
SHA1 696ad972849bf7696bf25437cffdcb5a24878f13
SHA256 49fa3a9121bb33ad3640932ccf68583eb1fc55c389b93cdc3b1207182b18edd9
SHA512 b6c246c82687b1b7cbc2fd2bd080dae54587c11908b3b263cb8e7e0263114552ed07df8a8af66437268683689c1b518dfced973b958166ca30e4a8061889dab7

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

C:\Users\Admin\AppData\Local\Temp\p8RbAWEoeFDJiyO3lGFD\Browsers\Chrome [ Default ] - Cookies.txt

MD5 8b6fa446a66c77d8f8d39338922cf53d
SHA1 2cef0b3a534a48f5f09546d2611111a1a745fcf9
SHA256 2e51f606a1c48b5ee9ac3243e9a4a82b35d8762ba1299d04f6501886bc880c73
SHA512 98d0d76bf8162b3ed297b59b94b0889442082ace867910db7a5fc822e69c57838284cd7a83ddfd0328a9beaf195670be91aae13c53533590ebd78db21a78ed04

C:\Users\Admin\AppData\Local\Temp\GB_NOVA_Admin_191.zip

MD5 e52bc382597f921aca2194947011fd1d
SHA1 4bdcbaae2edcea5a1fd9eae566c30c1422fff74b
SHA256 bb901b237c0b03a4f6ff6fe5076c27f171141525276a7a5bbb5d8fb04cc5095f
SHA512 12b0e0a2648ca17558b1242b7acb47e1d2fd4b678306046f150f9bda3f0d0ab7824cdda04d7a606b984fbba761f641de5a699ad53dcca4329d22a7914c366b42

C:\Users\Admin\AppData\Local\Temp\p8RbAWEoeFDJiyO3lGFD\Browsers\Bookmarks.txt

MD5 18e8c8afc0c5613cac3916e3a28fa9f1
SHA1 c0aaa69cddd31830f7ca218c33285e71d9cd1cb0
SHA256 ae25ff98749cf68d90dc60e5dc5284a44b439327f44b34d1abb3b8f10f1a3a0b
SHA512 697a62f6431a94e2686e67bf48a3f01d2f9e7be03ab93d0f48d107d7a6225397af9aeb291e1cf3082818b0f14b8afe73a3596217d9ac3cedac914afcd385818f