Malware Analysis Report

2024-10-18 23:46

Sample ID 241006-x52dks1erq
Target Bltools 2.9.1[PRO].zip
SHA256 1b68b264c499ff7ebdeb6250ff297a3c3b14842691f56975190452158597677c
Tags
themida exelastealer monster collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1b68b264c499ff7ebdeb6250ff297a3c3b14842691f56975190452158597677c

Threat Level: Known bad

The file Bltools 2.9.1[PRO].zip was found to be: Known bad.

Malicious Activity Summary

themida exelastealer monster collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer

Exela Stealer

Detects Monster Stealer.

Monster

Grants admin privileges

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Modifies Windows Firewall

Clipboard Data

Loads dropped DLL

Checks BIOS information in registry

Deletes itself

Executes dropped EXE

Themida packer

Reads user/profile data of web browsers

Looks up external IP address via web service

Network Service Discovery

Enumerates processes with tasklist

Hide Artifacts: Hidden Files and Directories

Suspicious use of NtSetInformationThreadHideFromDebugger

Launches sc.exe

Browser Information Discovery

Enumerates physical storage devices

System Network Connections Discovery

Unsigned PE

Embeds OpenSSL

Permission Groups Discovery: Local Groups

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Wi-Fi Discovery

Event Triggered Execution: Netsh Helper DLL

Gathers network information

Gathers system information

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Collects information from the system

Views/modifies file attributes

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Kills process with taskkill

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-06 19:27

Signatures

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-06 19:26

Reported

2024-10-06 19:34

Platform

win10v2004-20240802-en

Max time kernel

243s

Max time network

315s

Command Line

C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Bltools 2.9.1[PRO].zip"

Signatures

Detects Monster Stealer.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Exela Stealer

stealer exelastealer

Monster

stealer monster

Grants admin privileges

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe N/A

Reads user/profile data of web browsers

spyware stealer

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Network Service Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\ARP.EXE N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\ARP.EXE N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Browser Information Discovery

discovery

Embeds OpenSSL

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Permission Groups Discovery: Local Groups

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A

System Network Connections Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Collects information from the system

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 14002e80922b16d365937a46956b92703aca08af0000 C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\NodeSlot = "4" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = ffffffff C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A
N/A N/A C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4028 wrote to memory of 3872 N/A C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Bltools 2.9.1 [PRO].exe C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe
PID 4028 wrote to memory of 3872 N/A C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Bltools 2.9.1 [PRO].exe C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe
PID 4028 wrote to memory of 3872 N/A C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Bltools 2.9.1 [PRO].exe C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe
PID 4028 wrote to memory of 2480 N/A C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Bltools 2.9.1 [PRO].exe C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe
PID 4028 wrote to memory of 2480 N/A C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Bltools 2.9.1 [PRO].exe C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe
PID 2480 wrote to memory of 4372 N/A C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe
PID 2480 wrote to memory of 4372 N/A C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe
PID 4372 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 5044 wrote to memory of 4152 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5044 wrote to memory of 4152 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4492 wrote to memory of 1908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4492 wrote to memory of 1908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4372 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4536 wrote to memory of 4636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4536 wrote to memory of 4636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4372 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 3416 wrote to memory of 2728 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3416 wrote to memory of 2728 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4372 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 1220 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1220 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1700 wrote to memory of 1644 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 1700 wrote to memory of 1644 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 3644 wrote to memory of 3104 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3644 wrote to memory of 3104 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4900 wrote to memory of 1704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4900 wrote to memory of 1704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4372 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4372 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe C:\Windows\system32\cmd.exe
PID 4692 wrote to memory of 4920 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 4692 wrote to memory of 4920 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 3748 wrote to memory of 4468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3748 wrote to memory of 4468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4692 wrote to memory of 5008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\HOSTNAME.EXE
PID 4692 wrote to memory of 5008 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\HOSTNAME.EXE
PID 4692 wrote to memory of 3332 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4692 wrote to memory of 3332 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4692 wrote to memory of 4316 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 4692 wrote to memory of 4316 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 4316 wrote to memory of 3816 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4316 wrote to memory of 3816 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4692 wrote to memory of 4052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\query.exe
PID 4692 wrote to memory of 4052 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\query.exe
PID 4052 wrote to memory of 224 N/A C:\Windows\system32\query.exe C:\Windows\system32\quser.exe
PID 4052 wrote to memory of 224 N/A C:\Windows\system32\query.exe C:\Windows\system32\quser.exe
PID 4692 wrote to memory of 4448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Bltools 2.9.1[PRO].zip"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Bltools 2.9.1 [PRO].exe

"C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Bltools 2.9.1 [PRO].exe"

C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe

"C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe"

C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe

"C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe

"C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "chcp"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\chcp.com

chcp

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Get-Clipboard

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\HOSTNAME.EXE

hostname

C:\Windows\System32\Wbem\WMIC.exe

wmic logicaldisk get caption,description,providername

C:\Windows\system32\net.exe

net user

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user

C:\Windows\system32\query.exe

query user

C:\Windows\system32\quser.exe

"C:\Windows\system32\quser.exe"

C:\Windows\system32\net.exe

net localgroup

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup

C:\Windows\system32\net.exe

net localgroup administrators

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup administrators

C:\Windows\system32\net.exe

net user guest

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user guest

C:\Windows\system32\net.exe

net user administrator

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user administrator

C:\Windows\System32\Wbem\WMIC.exe

wmic startup get caption,command

C:\Windows\system32\tasklist.exe

tasklist /svc

C:\Windows\system32\ipconfig.exe

ipconfig /all

C:\Windows\system32\ROUTE.EXE

route print

C:\Windows\system32\ARP.EXE

arp -a

C:\Windows\system32\NETSTAT.EXE

netstat -ano

C:\Windows\system32\sc.exe

sc query type= service state= all

C:\Windows\system32\netsh.exe

netsh firewall show state

C:\Windows\system32\netsh.exe

netsh firewall show config

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe

"C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_1176_133727165786666379\stub.exe

"C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /IM "taskmgr.exe""

C:\Windows\system32\taskkill.exe

taskkill /F /IM "taskmgr.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "chcp"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\chcp.com

chcp

C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe

"C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\HOSTNAME.EXE

hostname

C:\Windows\System32\Wbem\WMIC.exe

wmic logicaldisk get caption,description,providername

C:\Windows\system32\net.exe

net user

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user

C:\Windows\system32\query.exe

query user

C:\Windows\system32\quser.exe

"C:\Windows\system32\quser.exe"

C:\Windows\system32\net.exe

net localgroup

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup

C:\Windows\system32\net.exe

net localgroup administrators

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup administrators

C:\Windows\system32\net.exe

net user guest

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user guest

C:\Windows\system32\net.exe

net user administrator

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user administrator

C:\Windows\System32\Wbem\WMIC.exe

wmic startup get caption,command

C:\Windows\system32\tasklist.exe

tasklist /svc

C:\Windows\system32\ipconfig.exe

ipconfig /all

C:\Windows\system32\ROUTE.EXE

route print

C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Bltools 2.9.1 [PRO].exe

"C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Bltools 2.9.1 [PRO].exe"

C:\Windows\system32\ARP.EXE

arp -a

C:\Windows\system32\NETSTAT.EXE

netstat -ano

C:\Windows\system32\sc.exe

sc query type= service state= all

C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe

"C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe"

C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe

"C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe"

C:\Windows\system32\netsh.exe

netsh firewall show state

C:\Users\Admin\AppData\Local\Temp\onefile_3712_133727165926046714\stub.exe

"C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\netsh.exe

netsh firewall show config

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe

"C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\CookiesCreator v1.2.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
N/A 127.0.0.1:60399 tcp
N/A 127.0.0.1:60406 tcp
N/A 127.0.0.1:60409 tcp
N/A 127.0.0.1:60411 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
N/A 127.0.0.1:60549 tcp
N/A 127.0.0.1:60557 tcp
N/A 127.0.0.1:60559 tcp
N/A 127.0.0.1:60561 tcp
US 8.8.8.8:53 74.239.69.13.in-addr.arpa udp

Files

C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\XConfig.setup.exe

MD5 025d637741b1b326ded2e99e6b54ed77
SHA1 5fb6a288559f54aeb42203cf5e44a072c74f942f
SHA256 d68b3cdca20f0b871a653a3203e4292846e766b45fb989856a2de0fb9e0c4860
SHA512 720f4f03febbe7fdd661c14349680f6511a69487b0bdf5cd47ab4594b1fad49edeb0bde8e287272d84e21efc916ba91ca71bfa2632eba76e379e07815163d26b

C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.exe

MD5 f48d8f28e2b8138e30b5031ae90f79f9
SHA1 6c6e00d7a5a295f7814f082c5650070c25e868ab
SHA256 c0e7d1d19d8d48d10db4458cfee55d4926e3bbe72147c8d7e6c0fbd1c33e66ec
SHA512 ea066497681861fa7ce2e7234569415c2621f9a80ef3dc7c86ac8bb382f697025ec87003b28f389e164f64aaccefb950917978772cb6b5a21fd18bf766f1f6a0

memory/3872-41-0x0000000000470000-0x0000000000BC0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\python310.dll

MD5 c80b5cb43e5fe7948c3562c1fff1254e
SHA1 f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256 058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512 faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

MD5 87596db63925dbfe4d5f0f36394d7ab0
SHA1 ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA256 92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512 e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\vcruntime140.dll

MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd

MD5 a4b636201605067b676cc43784ae5570
SHA1 e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256 f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA512 02096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_sqlite3.pyd

MD5 7f61eacbbba2ecf6bf4acf498fa52ce1
SHA1 3174913f971d031929c310b5e51872597d613606
SHA256 85de6d0b08b5cc1f2c3225c07338c76e1cab43b4de66619824f7b06cb2284c9e
SHA512 a5f6f830c7a5fadc3349b42db0f3da1fddb160d7e488ea175bf9be4732a18e277d2978720c0e294107526561a7011fadab992c555d93e77d4411528e7c4e695a

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\cryptography\hazmat\bindings\_rust.pyd

MD5 b364cecdba4b73c71116781b1c38d40f
SHA1 59ef6f46bd3f2ec17e78df8ee426d4648836255a
SHA256 10d009a3c97bf908961a19b4aaddc298d32959acc64bedf9d2a7f24c0261605b
SHA512 999c2da8e046c9f4103385c7d7dbb3bfdac883b6292dca9d67b36830b593f55ac14d6091eb15a41416c0bd65ac3d4a4a2b84f50d13906d36ed5574b275773ce7

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\sqlite3.dll

MD5 926dc90bd9faf4efe1700564aa2a1700
SHA1 763e5af4be07444395c2ab11550c70ee59284e6d
SHA256 50825ea8b431d86ec228d9fa6b643e2c70044c709f5d9471d779be63ff18bcd0
SHA512 a8703ff97243aa3bc877f71c0514b47677b48834a0f2fee54e203c0889a79ce37c648243dbfe2ee9e1573b3ca4d49c334e9bfe62541653125861a5398e2fe556

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd

MD5 adc412384b7e1254d11e62e451def8e9
SHA1 04e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA256 68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512 f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_asyncio.pyd

MD5 6eb3c9fc8c216cea8981b12fd41fbdcd
SHA1 5f3787051f20514bb9e34f9d537d78c06e7a43e6
SHA256 3b0661ef2264d6566368b677c732ba062ac4688ef40c22476992a0f9536b0010
SHA512 2027707824d0948673443dd54b4f45bc44680c05c3c4a193c7c1803a1030124ad6c8fbe685cc7aaf15668d90c4cd9bfb93de51ea8db4af5abe742c1ef2dcd08b

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\_hashlib.pyd

MD5 49ce7a28e1c0eb65a9a583a6ba44fa3b
SHA1 dcfbee380e7d6c88128a807f381a831b6a752f10
SHA256 1be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430
SHA512 cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_http_writer.pyd

MD5 e16a71fc322a3a718aeaeaef0eeeab76
SHA1 78872d54d016590df87208518e3e6515afce5f41
SHA256 51490359d8079232565187223517eca99e1ce55bc97b93cf966d2a5c1f2e5435
SHA512 a9a7877aa77d000ba2dd7d96cf88a0e9afb6f6decb9530c1d4e840c270dd1805e73401266b1c8e17c1418effb823c1bd91b13f82dbfc6dba455940e3e644de54

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\frozenlist\_frozenlist.pyd

MD5 911470750962640ceb3fd11e2aeecd14
SHA1 af797451d4028841d92f771885cb9d81afba3f96
SHA256 5c204f6966526af4dc0c0d6d29909b6f088c4fa781464f2948414d833b03094d
SHA512 637043c20dc17fbc472613c0e4f576f0a2211b7916b3488806aec30271cf1bd84bd790518335b88910662fd4844f8ed39fa75aa278577271a966756b8cd793f7

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\_uuid.pyd

MD5 13aa3af9aed86cc917177ae1f41acc9b
SHA1 f5d95679afda44a6689dbb45e93ebe0e9cd33d69
SHA256 51dd1ea5e8cacf7ec4cadefdf685334c7725ff85978390d0b3d67fc8c54fe1db
SHA512 e1f5dbd6c0afcf207de0100cba6f1344feb0006a5c12dc92768ab2d24e3312f0852f3cd31a416aafeb0471cd13a6c0408f0da62956f7870b2e22d174a8b23c45

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\aiohttp\_websocket.pyd

MD5 9358095a5dc2d4b25fc1c416eea48d2d
SHA1 faaee08c768e8eb27bc4b2b9d0bf63c416bb8406
SHA256 4a5c9f8c3bca865df94ac93355e3ad492de03ae5fea41c1fa82fa4360c592ba5
SHA512 c3d81ddbbe48a56530ea3e2500a78c396385f8ca820b3d71f8e5336ab0c6d484bc2b837ae0a2edb39d0fe24c37815f1b0ccfe25235197f1af19e936ddb41e594

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\aiohttp\_http_parser.pyd

MD5 9642c0a5fb72dfe2921df28e31faa219
SHA1 67a963157ee7fc0c30d3807e8635a57750ca0862
SHA256 580a004e93bed99820b1584dffaf0c4caa9fbbf4852ccded3b2b99975299367b
SHA512 f84b7cde87186665a700c3017efcbcc6c19f5dc2c7b426d427dddbcbdec38b6189dd60ce03153fb14b6ea938d65aab99da33bda63b48e3e9ce9e5d3555b50a04

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\aiohttp\_helpers.pyd

MD5 d2bf6ca0df56379f1401efe347229dd2
SHA1 95c6a524a9b64ec112c32475f06a0821ff7e79c9
SHA256 04d56d6aa727665802283b8adf9b873c1dd76dfc7265a12c0f627528ba706040
SHA512 b4a2b9f71b156731aa071d13bf8dcffec4091d8d2fab47aea1ff47cd7abff13e28acf1d9456a97eb7a5723dbfa166fc63de11c63dc5cb63b13b4df9930390377

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\yarl\_quoting_c.pyd

MD5 8b4cd87707f15f838b5db8ed5b5021d2
SHA1 bbc05580a181e1c03e0a53760c1559dc99b746fe
SHA256 eefb46501ef97baf29a93304f58674e70f5ccecafb183f230e5ce7872a852f56
SHA512 6768cff12fa22fe8540a3f6bdb350a5fcec0b2a0f01531458eb23f77b24460620cd400078fd1ec63738884c2b78920e428126833953c26b8dc8ad8b7c069415d

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\unicodedata.pyd

MD5 102bbbb1f33ce7c007aac08fe0a1a97e
SHA1 9a8601bea3e7d4c2fa6394611611cda4fc76e219
SHA256 2cf6c5dea30bb0584991b2065c052c22d258b6e15384447dcea193fdcac5f758
SHA512 a07731f314e73f7a9ea73576a89ccb8a0e55e53f9b5b82f53121b97b1814d905b17a2da9bd2eda9f9354fc3f15e3dea7a613d7c9bc98c36bba653743b24dfc32

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\multidict\_multidict.pyd

MD5 ddd4c0ae1e0d166c22449e9dcdca20d7
SHA1 ff0e3d889b4e8bc43b0f13aa1154776b0df95700
SHA256 74ec52418c5d38a63add94228c6f68cf49519666ae8bcb7ac199f7d539d8612c
SHA512 c8464a77ba8b504ba9c7873f76499174095393c42dc85a9c1be2875c3661cda928851e37013e4ac95ba539eed984bf71c0fcc2cb599f3f0c4c1588d4a692bdfd

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\_overlapped.pyd

MD5 7e6bd435c918e7c34336c7434404eedf
SHA1 f3a749ad1d7513ec41066ab143f97fa4d07559e1
SHA256 0606a0c5c4ab46c4a25ded5a2772e672016cac574503681841800f9059af21c4
SHA512 c8bf4b1ec6c8fa09c299a8418ee38cdccb04afa3a3c2e6d92625dbc2de41f81dd0df200fd37fcc41909c2851ac5ca936af632307115b9ac31ec020d9ed63f157

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\libcrypto-1_1.dll

MD5 ab01c808bed8164133e5279595437d3d
SHA1 0f512756a8db22576ec2e20cf0cafec7786fb12b
SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA512 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\libssl-1_1.dll

MD5 de72697933d7673279fb85fd48d1a4dd
SHA1 085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA512 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\_ssl.pyd

MD5 35f66ad429cd636bcad858238c596828
SHA1 ad4534a266f77a9cdce7b97818531ce20364cb65
SHA256 58b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
SHA512 1cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\_socket.pyd

MD5 e137df498c120d6ac64ea1281bcab600
SHA1 b515e09868e9023d43991a05c113b2b662183cfe
SHA256 8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
SHA512 cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\_cffi_backend.pyd

MD5 ebb660902937073ec9695ce08900b13d
SHA1 881537acead160e63fe6ba8f2316a2fbbb5cb311
SHA256 52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd
SHA512 19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\python3.dll

MD5 07bd9f1e651ad2409fd0b7d706be6071
SHA1 dfeb2221527474a681d6d8b16a5c378847c59d33
SHA256 5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512 def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\_lzma.pyd

MD5 b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA1 4efe3f21be36095673d949cceac928e11522b29c
SHA256 80a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512 e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\onefile_2480_133727164859280433\stub.exe

MD5 6670b9a06b5ab7fb49ca6d5e56f43be0
SHA1 8d5cf860b24a4b5a10e3b0fd431df823836c97c5
SHA256 17a9b376d9eeeb3bf20a25629f6724540c3f6dbbf24672204e1a8e50b79f45df
SHA512 30da6a2c4d98b4ca24f694030d33d5d8e252109f0c187d2a7482fc45747d6d1f24170643f4a414310f5f5fa71be3109b796338d376d880481c5316a4b0b87c6c

memory/3872-159-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aguxsxhp.rkv.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3104-161-0x000002291B6D0000-0x000002291B6F2000-memory.dmp

memory/3872-173-0x00000000058C0000-0x00000000058E4000-memory.dmp

memory/3872-174-0x0000000006360000-0x0000000006C8C000-memory.dmp

memory/3872-175-0x0000000005A80000-0x0000000005AD0000-memory.dmp

memory/3872-176-0x0000000005B30000-0x0000000005B90000-memory.dmp

memory/3872-177-0x0000000005A30000-0x0000000005A50000-memory.dmp

memory/3872-179-0x0000000006C90000-0x0000000007234000-memory.dmp

memory/3872-181-0x0000000005CB0000-0x0000000005DF2000-memory.dmp

memory/3872-182-0x0000000007300000-0x00000000073BA000-memory.dmp

memory/3872-183-0x00000000073C0000-0x0000000007452000-memory.dmp

memory/3872-184-0x0000000009360000-0x0000000009398000-memory.dmp

memory/3872-185-0x0000000009330000-0x000000000933E000-memory.dmp

memory/3872-186-0x0000000009170000-0x0000000009182000-memory.dmp

memory/3872-187-0x00000000090D0000-0x00000000090D8000-memory.dmp

memory/2480-188-0x00007FF6A8AC0000-0x00007FF6A9595000-memory.dmp

memory/4372-189-0x00007FF7FD7A0000-0x00007FF7FE9D6000-memory.dmp

memory/4372-198-0x00007FF7FD7A0000-0x00007FF7FE9D6000-memory.dmp

memory/2480-199-0x00007FF6A8AC0000-0x00007FF6A9595000-memory.dmp

memory/4316-201-0x0000021704020000-0x0000021704021000-memory.dmp

memory/4316-202-0x0000021704020000-0x0000021704021000-memory.dmp

memory/4316-200-0x0000021704020000-0x0000021704021000-memory.dmp

memory/4316-212-0x0000021704020000-0x0000021704021000-memory.dmp

memory/4316-211-0x0000021704020000-0x0000021704021000-memory.dmp

memory/4316-210-0x0000021704020000-0x0000021704021000-memory.dmp

memory/4316-209-0x0000021704020000-0x0000021704021000-memory.dmp

memory/4316-208-0x0000021704020000-0x0000021704021000-memory.dmp

memory/4316-207-0x0000021704020000-0x0000021704021000-memory.dmp

memory/4316-206-0x0000021704020000-0x0000021704021000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Web.db

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\Web.db

MD5 2e5b34ca73bac7d39579ae5af5c50268
SHA1 910b0865cce750b73e308d0c9314edcdcf4162bb
SHA256 79f7541d73ed1744fbc041fdeaf95cae2e2a43cf9d73f6d9476b67a5c2ea9695
SHA512 95dcb404558da6bf1b58640440f3e26b13bf53b8fe05932e85b85dea7e629a544f2bfef094fdd23fd2ad0692297aad338e23c9e6e516e5c852d6d7c1c97249fc

C:\Users\Admin\AppData\Local\Temp\HistoryData.db

MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

C:\Users\Admin\AppData\Local\Temp\HistoryData.db

MD5 9618e15b04a4ddb39ed6c496575f6f95
SHA1 1c28f8750e5555776b3c80b187c5d15a443a7412
SHA256 a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512 f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

memory/4544-301-0x0000015A64FB0000-0x0000015A651CC000-memory.dmp

memory/1176-305-0x00007FF6A8AC0000-0x00007FF6A9595000-memory.dmp

memory/1656-306-0x00007FF691F50000-0x00007FF693186000-memory.dmp

memory/4172-343-0x00007FF702740000-0x00007FF703976000-memory.dmp

memory/3712-349-0x00007FF6A8AC0000-0x00007FF6A9595000-memory.dmp

memory/1656-359-0x00007FF691F50000-0x00007FF693186000-memory.dmp

memory/2880-362-0x000001CD699A0000-0x000001CD699A1000-memory.dmp

memory/2880-360-0x000001CD699A0000-0x000001CD699A1000-memory.dmp

memory/2880-361-0x000001CD699A0000-0x000001CD699A1000-memory.dmp

memory/2880-369-0x000001CD699A0000-0x000001CD699A1000-memory.dmp

memory/2880-368-0x000001CD699A0000-0x000001CD699A1000-memory.dmp

memory/2880-367-0x000001CD699A0000-0x000001CD699A1000-memory.dmp

memory/2880-366-0x000001CD699A0000-0x000001CD699A1000-memory.dmp

memory/2880-365-0x000001CD699A0000-0x000001CD699A1000-memory.dmp

memory/2880-364-0x000001CD699A0000-0x000001CD699A1000-memory.dmp

memory/1656-373-0x00007FF691F50000-0x00007FF693186000-memory.dmp

memory/1176-374-0x00007FF6A8AC0000-0x00007FF6A9595000-memory.dmp

C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.ini

MD5 081de7d9abc4a3fedea2f5277ae28d26
SHA1 dedb83aa9f3fb2960faea46eb019d9e5e14de4df
SHA256 500818ed29a7a7dcea6514c8fa6ea9cbd9a88e97a51f8e4eab32033842ba0f5d
SHA512 4bd5a99826c3cb0b87e96053080b5f3c7d7363d7e35405ae842742ac3a7935ea2e5ea1fac2b5f22801b7d9f3d33adb5463900dd20cd6aa5da56fea54e3b26fda

C:\Users\Admin\Desktop\Bltools 2.9.1[PRO]\Settings.ini

MD5 feac86c1d86d5893122e23a633a15060
SHA1 9025d73590d20f9674773b4159df1f0f1a6621d4
SHA256 8057b4d5b63cc7673911fe76484919d80b6a94856a3ebb46161b35c24b03279a
SHA512 3e8560cabbb108ca7b70fcb22e8f5b63629d871f8ec49cf397c233724a2e7fa3d16ab53f71a4998f981008677a6c5a6e232d96116b743a6ad4e8fe2fd2f2032a

memory/4036-392-0x0000000000C10000-0x0000000001502000-memory.dmp

memory/4036-396-0x0000000000C10000-0x0000000001502000-memory.dmp

memory/4036-397-0x0000000000C10000-0x0000000001502000-memory.dmp

memory/4036-398-0x00000000054A0000-0x00000000054AA000-memory.dmp

memory/4036-400-0x0000000000C10000-0x0000000001502000-memory.dmp

memory/4036-403-0x0000000000C10000-0x0000000001502000-memory.dmp