b8735a6c2caa10ed5e886a60be7f2a1edb55e5d26d60b24d24af5613a8a0e474

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data.exe
Size

5.6MB
MD5

d650ccbec4cef66b790c0adbd0c690ed
SHA1

7c5323641a28170edb3121d9ad15d7bf643d801d
SHA256

b8735a6c2caa10ed5e886a60be7f2a1edb55e5d26d60b24d24af5613a8a0e474
SHA512

332dc8e1b3952ac3b3fbcfdf1634eaf9720d6bd85e6a1f0baef0f095c97a98d288f301b774c4d041c45ea8ea5ed8e52e8d786a874b8d0ce41dd5dd25a961b535
SSDEEP

98304:6W1l27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6Uc:6jOuK6mn9NzgMoYkSIvUcwti7TQlvciE

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2656	data.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
1772	tasklist.exe
1992	tasklist.exe
1564	tasklist.exe
2156	tasklist.exe
1568	tasklist.exe
1316	tasklist.exe
940	tasklist.exe
304	tasklist.exe
2148	tasklist.exe
2064	tasklist.exe
748	tasklist.exe
1068	tasklist.exe
2508	tasklist.exe
2788	tasklist.exe
2352	tasklist.exe
1900	tasklist.exe
1724	tasklist.exe
1904	tasklist.exe
1560	tasklist.exe
2080	tasklist.exe
1976	tasklist.exe
2052	tasklist.exe
2496	tasklist.exe
2204	tasklist.exe
2980	tasklist.exe
2504	tasklist.exe
2344	tasklist.exe
2984	tasklist.exe
848	tasklist.exe
2560	tasklist.exe
1988	tasklist.exe
2792	tasklist.exe
2512	tasklist.exe
2092	tasklist.exe
1612	tasklist.exe
1576	tasklist.exe
280	tasklist.exe
2552	tasklist.exe
2520	tasklist.exe
2284	tasklist.exe
1504	tasklist.exe
2308	tasklist.exe
2356	tasklist.exe
448	tasklist.exe
2896	tasklist.exe
1892	tasklist.exe
1940	tasklist.exe
1668	tasklist.exe
1932	tasklist.exe
1072	tasklist.exe
552	tasklist.exe
2244	tasklist.exe
2824	tasklist.exe
2648	tasklist.exe
2556	tasklist.exe
3044	tasklist.exe
1280	tasklist.exe
1448	tasklist.exe
2228	tasklist.exe
2528	tasklist.exe
308	tasklist.exe
824	tasklist.exe
752	tasklist.exe
1292	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
2588	timeout.exe
2388	timeout.exe
1772	timeout.exe
620	timeout.exe
2000	timeout.exe
2732	timeout.exe
2192	timeout.exe
1480	timeout.exe
2496	timeout.exe
2108	timeout.exe
2400	timeout.exe
372	timeout.exe
2560	timeout.exe
2096	timeout.exe
1516	timeout.exe
2316	timeout.exe
1860	timeout.exe
376	timeout.exe
2344	timeout.exe
2244	timeout.exe
2812	timeout.exe
2020	timeout.exe
2920	timeout.exe
1760	timeout.exe
1136	timeout.exe
1716	timeout.exe
1928	timeout.exe
2036	timeout.exe
2184	timeout.exe
1892	timeout.exe
2832	timeout.exe
2612	timeout.exe
2068	timeout.exe
880	timeout.exe
1448	timeout.exe
788	timeout.exe
1692	timeout.exe
2168	timeout.exe
2940	timeout.exe
632	timeout.exe
1660	timeout.exe
2984	timeout.exe
2060	timeout.exe
928	timeout.exe
1564	timeout.exe
2076	timeout.exe
2132	timeout.exe
1104	timeout.exe
1348	timeout.exe
2012	timeout.exe
304	timeout.exe
1876	timeout.exe
1168	timeout.exe
2944	timeout.exe
1532	timeout.exe
2120	timeout.exe
840	timeout.exe
1500	timeout.exe
2176	timeout.exe
2348	timeout.exe
1944	timeout.exe
952	timeout.exe
1508	timeout.exe
1316	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2656	data.exe
2656	data.exe
2656	data.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	data.exe
Token: SeDebugPrivilege	2552	tasklist.exe
Token: SeDebugPrivilege	2244	tasklist.exe
Token: SeDebugPrivilege	2532	tasklist.exe
Token: SeDebugPrivilege	2148	tasklist.exe
Token: SeDebugPrivilege	2896	tasklist.exe
Token: SeDebugPrivilege	584	tasklist.exe
Token: SeDebugPrivilege	1560	tasklist.exe
Token: SeDebugPrivilege	1072	tasklist.exe
Token: SeDebugPrivilege	2352	tasklist.exe
Token: SeDebugPrivilege	2844	tasklist.exe
Token: SeDebugPrivilege	1952	tasklist.exe
Token: SeDebugPrivilege	1568	tasklist.exe
Token: SeDebugPrivilege	1772	tasklist.exe
Token: SeDebugPrivilege	1892	tasklist.exe
Token: SeDebugPrivilege	2008	tasklist.exe
Token: SeDebugPrivilege	1652	tasklist.exe
Token: SeDebugPrivilege	896	tasklist.exe
Token: SeDebugPrivilege	1280	tasklist.exe
Token: SeDebugPrivilege	1528	tasklist.exe
Token: SeDebugPrivilege	2520	tasklist.exe
Token: SeDebugPrivilege	1940	tasklist.exe
Token: SeDebugPrivilege	1668	tasklist.exe
Token: SeDebugPrivilege	2848	tasklist.exe
Token: SeDebugPrivilege	2632	tasklist.exe
Token: SeDebugPrivilege	1756	tasklist.exe
Token: SeDebugPrivilege	2512	tasklist.exe
Token: SeDebugPrivilege	1572	tasklist.exe
Token: SeDebugPrivilege	2824	tasklist.exe
Token: SeDebugPrivilege	2144	tasklist.exe
Token: SeDebugPrivilege	1992	tasklist.exe
Token: SeDebugPrivilege	2560	tasklist.exe
Token: SeDebugPrivilege	2200	tasklist.exe
Token: SeDebugPrivilege	2532	tasklist.exe
Token: SeDebugPrivilege	1292	tasklist.exe
Token: SeDebugPrivilege	2504	tasklist.exe
Token: SeDebugPrivilege	584	tasklist.exe
Token: SeDebugPrivilege	1988	tasklist.exe
Token: SeDebugPrivilege	448	tasklist.exe
Token: SeDebugPrivilege	1900	tasklist.exe
Token: SeDebugPrivilege	2788	tasklist.exe
Token: SeDebugPrivilege	2360	tasklist.exe
Token: SeDebugPrivilege	2080	tasklist.exe
Token: SeDebugPrivilege	2380	tasklist.exe
Token: SeDebugPrivilege	2968	tasklist.exe
Token: SeDebugPrivilege	1792	tasklist.exe
Token: SeDebugPrivilege	2328	tasklist.exe
Token: SeDebugPrivilege	2064	tasklist.exe
Token: SeDebugPrivilege	1732	tasklist.exe
Token: SeDebugPrivilege	752	tasklist.exe
Token: SeDebugPrivilege	2256	tasklist.exe
Token: SeDebugPrivilege	2520	tasklist.exe
Token: SeDebugPrivilege	552	tasklist.exe
Token: SeDebugPrivilege	1668	tasklist.exe
Token: SeDebugPrivilege	2812	tasklist.exe
Token: SeDebugPrivilege	308	tasklist.exe
Token: SeDebugPrivilege	608	tasklist.exe
Token: SeDebugPrivilege	2948	tasklist.exe
Token: SeDebugPrivilege	2748	tasklist.exe
Token: SeDebugPrivilege	2792	tasklist.exe
Token: SeDebugPrivilege	2580	tasklist.exe
Token: SeDebugPrivilege	2036	tasklist.exe
Token: SeDebugPrivilege	2392	tasklist.exe
Token: SeDebugPrivilege	2528	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2572	2656	data.exe	31
PID 2656 wrote to memory of 2572	2656	data.exe	31
PID 2656 wrote to memory of 2572	2656	data.exe	31
PID 2572 wrote to memory of 2740	2572	cmd.exe	33
PID 2572 wrote to memory of 2740	2572	cmd.exe	33
PID 2572 wrote to memory of 2740	2572	cmd.exe	33
PID 2572 wrote to memory of 2552	2572	cmd.exe	34
PID 2572 wrote to memory of 2552	2572	cmd.exe	34
PID 2572 wrote to memory of 2552	2572	cmd.exe	34
PID 2572 wrote to memory of 2560	2572	cmd.exe	35
PID 2572 wrote to memory of 2560	2572	cmd.exe	35
PID 2572 wrote to memory of 2560	2572	cmd.exe	35
PID 2572 wrote to memory of 2620	2572	cmd.exe	36
PID 2572 wrote to memory of 2620	2572	cmd.exe	36
PID 2572 wrote to memory of 2620	2572	cmd.exe	36
PID 2572 wrote to memory of 2244	2572	cmd.exe	37
PID 2572 wrote to memory of 2244	2572	cmd.exe	37
PID 2572 wrote to memory of 2244	2572	cmd.exe	37
PID 2572 wrote to memory of 2200	2572	cmd.exe	38
PID 2572 wrote to memory of 2200	2572	cmd.exe	38
PID 2572 wrote to memory of 2200	2572	cmd.exe	38
PID 2572 wrote to memory of 2012	2572	cmd.exe	39
PID 2572 wrote to memory of 2012	2572	cmd.exe	39
PID 2572 wrote to memory of 2012	2572	cmd.exe	39
PID 2572 wrote to memory of 2532	2572	cmd.exe	40
PID 2572 wrote to memory of 2532	2572	cmd.exe	40
PID 2572 wrote to memory of 2532	2572	cmd.exe	40
PID 2572 wrote to memory of 2952	2572	cmd.exe	41
PID 2572 wrote to memory of 2952	2572	cmd.exe	41
PID 2572 wrote to memory of 2952	2572	cmd.exe	41
PID 2572 wrote to memory of 2252	2572	cmd.exe	42
PID 2572 wrote to memory of 2252	2572	cmd.exe	42
PID 2572 wrote to memory of 2252	2572	cmd.exe	42
PID 2572 wrote to memory of 2148	2572	cmd.exe	43
PID 2572 wrote to memory of 2148	2572	cmd.exe	43
PID 2572 wrote to memory of 2148	2572	cmd.exe	43
PID 2572 wrote to memory of 2140	2572	cmd.exe	44
PID 2572 wrote to memory of 2140	2572	cmd.exe	44
PID 2572 wrote to memory of 2140	2572	cmd.exe	44
PID 2572 wrote to memory of 2368	2572	cmd.exe	45
PID 2572 wrote to memory of 2368	2572	cmd.exe	45
PID 2572 wrote to memory of 2368	2572	cmd.exe	45
PID 2572 wrote to memory of 2896	2572	cmd.exe	46
PID 2572 wrote to memory of 2896	2572	cmd.exe	46
PID 2572 wrote to memory of 2896	2572	cmd.exe	46
PID 2572 wrote to memory of 1944	2572	cmd.exe	47
PID 2572 wrote to memory of 1944	2572	cmd.exe	47
PID 2572 wrote to memory of 1944	2572	cmd.exe	47
PID 2572 wrote to memory of 1392	2572	cmd.exe	48
PID 2572 wrote to memory of 1392	2572	cmd.exe	48
PID 2572 wrote to memory of 1392	2572	cmd.exe	48
PID 2572 wrote to memory of 584	2572	cmd.exe	49
PID 2572 wrote to memory of 584	2572	cmd.exe	49
PID 2572 wrote to memory of 584	2572	cmd.exe	49
PID 2572 wrote to memory of 628	2572	cmd.exe	50
PID 2572 wrote to memory of 628	2572	cmd.exe	50
PID 2572 wrote to memory of 628	2572	cmd.exe	50
PID 2572 wrote to memory of 2164	2572	cmd.exe	51
PID 2572 wrote to memory of 2164	2572	cmd.exe	51
PID 2572 wrote to memory of 2164	2572	cmd.exe	51
PID 2572 wrote to memory of 1560	2572	cmd.exe	52
PID 2572 wrote to memory of 1560	2572	cmd.exe	52
PID 2572 wrote to memory of 1560	2572	cmd.exe	52
PID 2572 wrote to memory of 1996	2572	cmd.exe	53

C:\Users\Admin\AppData\Local\Temp\data.exe
"C:\Users\Admin\AppData\Local\Temp\data.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp37E2.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp37E2.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2740
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2560
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2620
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2200
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2012
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2952
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2252
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2140
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2368
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2896
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1944
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1392
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:584
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:628
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2164
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1996
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:804
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1676
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2020
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2352
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2004
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2536
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2844
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2608
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1712
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1952
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1504
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:620
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1760
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2168
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1772
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2356
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2108
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1892
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2104
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2940
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2236
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1500
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1300
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2064
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:896
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:880
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:304
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:872
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1624
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2256
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1780
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2520
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2056
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1716
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1940
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2192
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:376
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1668
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:600
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1876
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1728
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:984
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1476
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1816
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:296
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2464
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2404
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1576
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2780
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2808
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2840
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2768
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2752
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2344
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2660
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2600
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2668
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2184
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2072
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2528
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2952
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2400
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1292
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2148
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2068
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2384
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:632
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:584
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:628
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2000
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1976
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1136
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:448
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1072
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2156
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2152
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:788
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2616
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:316
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1952
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2340
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1196
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2168
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1592
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2176
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2972
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1168
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1792
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2132
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1164
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2212
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1936
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2124
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:880
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:288
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1692
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:752
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1624
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1528
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1780
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2860
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2520
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1720
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1812
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:552
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1708
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:372
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1668
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:600
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2060
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1520
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2920
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:308
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2632
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2732
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:608
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:864
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1580
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:1724
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1552
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2772
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2800
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2764
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2652
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2768
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2672
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2344
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2568
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2544
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1972
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2244
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2392
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2944
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2348
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2528
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1532
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2952
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:748
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2444
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1292
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1324
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1620
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1944
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2052
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2332
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2448
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1472
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2000
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1988
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:1976
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1136
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:840
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:1448
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2452
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:952
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2648
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2352
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:780
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:1904
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2844
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1508
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1740
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2360
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2084
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1548
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2080
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2372
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2092
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2380
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1892
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:1068
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2976
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2096
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:1932
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1308
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:948
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1104
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2328
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:928
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:3068
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2916
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2988
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:304
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1896
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1516
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2508
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1800
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:268
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1716
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1940
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2192
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2288
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2644
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2492
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2284
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:3004
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2848
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2784
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2824
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2832
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2556
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2736
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2316
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2344
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1992
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1660
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:1564
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1524
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2560
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2036
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1972
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:656
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1468
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2944
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2228
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1052
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1532
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2368
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2440
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2444
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1480
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2068
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1620
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2588
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2052
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2332
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2016
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1860
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1472
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2160
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:1988
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:448
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1136
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2496
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1492
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:400
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:1072
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1628
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1448
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1208
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:320
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1900
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2828
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:620
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1904
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:1504
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2204
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1948
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1760
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2356
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1568
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1772
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2980
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2088
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2984
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2008
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1068
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1928
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:280
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2132
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:1316
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:940
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1104
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:848
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:824
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2124
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:904
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2864
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:304
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1348
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2432
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2508
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:1612
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2032
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1716
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:552
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1876
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:372
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1668
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:984
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2060
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2308
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1816
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2388
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2464
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:792
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1580
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:1576
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:876
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2812
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1736
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2848
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2720
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2824
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2144
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2024
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2792
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2672
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2612
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2624
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2548
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1604
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:3044
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1660
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1564
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1524
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2560
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2036
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1972
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2728
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2780
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:656
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2960
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2944
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2228
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1444
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1532
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2400
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2896
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2148
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1216
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1304
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2384
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:632
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2904
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2120
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:804
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:3036
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1860
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:1996
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1976
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:1916
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:828
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:680
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2496
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2276
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1808
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:840
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2156
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2452
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:952
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:292
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2352
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:780
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2216
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2844
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1508
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2204
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1948
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1760
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2356
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1568
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1772
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2980
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2088
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2984
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    PID:2008
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1068
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1928
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:280
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2132
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1316
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:940
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1104
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:848
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:824
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2124
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2076
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:304
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1528
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1348
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2656"
    3⤵
    - Enumerates processes with tasklist
    PID:2508
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:1720
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp37E2.tmp.bat

Filesize
269B

MD5
ba52ab68a3faf84e4ca9ddc8eea4fe6c

SHA1
ab84ccf295334feb7f23e3c11ff3e6d351b9d1f2

SHA256
02454bb7859bc721a88105c7b1c52e1ff2c4e50b02fa82c912ac92dac77b89b1

SHA512
26256280b7dd261f1c5aa4626c30513703862b915a191962dd55cc402c0637bcd806d169e3002c4464b9c87e216a2d61ad1126a0579034b15a27100d6b545add

Download Submit
C:\Users\Admin\Desktop\ApproveUnregister.xml

Filesize
179KB

MD5
0257649a313339aade2d5dcea52256bd

SHA1
af27eb3112dd578ac61fa79641dbbd6bb65007f4

SHA256
1e53511041af4e7a53dfde19c35d0980f96e579d2a26a72cfe7cc6d95e36a645

SHA512
7e7fc2309ca6170c61630056e0d88857f6a0266b7e28092b3aadcd0d9d837a7080a2dd6ac2dc7ef2a9808f761969971be27dca1bd9a2e4f9b937d572219443d2

Download Submit
C:\Users\Admin\Desktop\CompareRemove.bmp

Filesize
347KB

MD5
44a77a78dda5ca0d30e6124b4c2175ab

SHA1
dd3dfa112605585bcf1ff67727337ddf9bbeaf4a

SHA256
88332b0ded4ae2bdecf6d7dd4ac7fa4f35e3f7c6978f47786301f7053017ed23

SHA512
95485b1efee37fe9cb6d37bc50d21efe87fd3a64b6acd61d24e213edd5bfa29c7eb3593e8823366434e27d12678891d74feafd99cc414e68070adc2b5ea41a9b

Download Submit
C:\Users\Admin\Desktop\CompressOut.docx

Filesize
21KB

MD5
dc158ccbfc59fababa5d7c8c62330a5e

SHA1
1978b8f0975e7e4b43b8e5298a511862063b1259

SHA256
65571caeb2036126503aa58f5e4edc17496c478a6a5d57bbbcf22a219fb3b0f4

SHA512
0ed53663adfc81f0c4d220b1f90062ac10707c8c6a578bf5f401ed48101c39eed4b4f498d095fef454883bddc2fee7442c0c1f2b6d35aebb8b3ad94826a695d4

Download Submit
C:\Users\Admin\Desktop\ConvertFromDisable.ocx

Filesize
94KB

MD5
54d7cfe9d0cb64e811e8ddb1b06a3457

SHA1
37e310c1a9d73ad5a7b66e7bf9674668435147b1

SHA256
a27b1af183c4afb507ad51b56481bc90a25f6a5feb323c58b0d161ad2824e963

SHA512
6fd65838adb8e80d9abb047333860536bab2330867d0aeae71132ce0e99369bcd2c4cc65b501c65b15f01146cf9247e716133d2159cd31d7ab664eed0be83eeb

Download Submit
C:\Users\Admin\Desktop\DisableConnect.xlsx

Filesize
13KB

MD5
c943e5c94abd1f36ef4826a06aad4536

SHA1
b9a7c1c659f62fc5a73cd7b95fb44705bae7ad30

SHA256
6dcd85cdbe832b94d5c6f8bee59e9a6c706503b6d91df7e20699f6916331850c

SHA512
96857cdeb3688f6e9b3f8db627ec4cfb339d192cbad1adcbc3350ebf9af1c8ad79629bc70c028c5687e5a6e2e3dd8756d9a8e4ed2a3a87fac6e0fa0285a69822

Download Submit
C:\Users\Admin\Desktop\EnableUnblock.ico

Filesize
149KB

MD5
b47384c0f0dd5f4bf15ea788210d68db

SHA1
e599cfa525bf2c2ce8f6f4651057b5f84f8e2e96

SHA256
87f4809c90d04d02ca4eeef83a635dc0c334f020418e6c66b9b8e17f8df03202

SHA512
a55a2b3b6e42161d8e6f8fdf325274fb65b796edb9c87ef146ffed54a60fddb108f5999c73850cbb9942938baaec76e0d311f2c435e7414a5b61df1f93125339

Download Submit
C:\Users\Admin\Desktop\EnterPing.xlsx

Filesize
12KB

MD5
81849422b252299c9244709c9753af05

SHA1
7be109432f01d75639edbdcde66308b9d3189067

SHA256
07c44af7f47cfee7bff19fdf809cbe88de93a019d948cb1768390fa87cbf875d

SHA512
90e59463236edd62ff7412387641d70f5dcd36f8c9fdf570790f1d832ed840627f3d835faff33e86471bf31e3a923328f56a4ccb3af7eae8322e830c52d12e9a

Download Submit
C:\Users\Admin\Desktop\ExitInvoke.wdp

Filesize
197KB

MD5
574ec14bcbecc58c24583dee68e50be4

SHA1
fb2858b9f0358c8a2c97f2eecc3d9d36598fd682

SHA256
5b4775eea42c00786cab342a78d37d08473db4d2a32302910915ed593a266001

SHA512
c1322c91b65e5c856026f2b49c0840685107b38d80207c4112f66a1fd718041a7f1cb75994a9f37de2c8964f6dd7b8fca4bf2702e440ef2b176d88ac26ebe826

Download Submit
C:\Users\Admin\Desktop\HideApprove.css

Filesize
106KB

MD5
77db2ceb4b03f66734986f4570275724

SHA1
419379cd4d5def2b4f830499362433334e9a3951

SHA256
2251a45ab78a70ed118bf5146f92d8f0669621602467467e9b0e9d39602f8b65

SHA512
8b7798fab459e76a38c0910bed39d649abadf5a4e80190ad8c3887490b67886bade6272e85e5958ff1e3e28623f76ebcc1c2b8fc6abc46c46eb2308e99ee079e

Download Submit
C:\Users\Admin\Desktop\JoinAssert.ex_

Filesize
252KB

MD5
e7ca31cd3cdd6f7a53ee387e1b18b0b0

SHA1
1694aa4b98385d4f07b94c1835f1b8645f180404

SHA256
c061c61985c8aa15c11d6049fdef8d3ad8136a98ffbec62c87498b5732b36704

SHA512
f145cd76fcdc8c6d35dfea2cbe48cc61f912418af19f084738fb61e59a186a93297f6c26bfeff0a93c5678fcc5c8dc8292bae89b2a2cb187c2f61cf90e17e17b

Download Submit
C:\Users\Admin\Desktop\JoinUnblock.tmp

Filesize
167KB

MD5
e4f96a86a142a69d0e6a11040487a317

SHA1
806ce0ff22a7c3073aab6b62992297a445cf7ffe

SHA256
a6e9bc6244a42b286bfe66c26a1d1714f99d920c52ce0ecbe6f61b845f951a0a

SHA512
3adb39a878d1cfd670ef9e11cdeec2a983625ede06d52fa348d1b7236518564ee68cbc18c091c1c2848181081f27f771e33680fcb26476a0a15665c5a7e74b57

Download Submit
C:\Users\Admin\Desktop\MeasureEdit.i64

Filesize
222KB

MD5
6f0e99f881b9f4864b5ddef146f550c0

SHA1
24cdf9932596f9b2ed8b1526a5f1d5c3e45e79fd

SHA256
d6803820f58014d7dea289ae5d6e899c762dfe7f77d941e5d98ca40c92f91f8c

SHA512
48cb7790cc11cc8825d467995ff66a1cc73fbc0edd47d9ca77f0101109ab53b076132b0baa5e370ce5579405c46f44e53366989b60d626d05844bdbd8e33a91f

Download Submit
C:\Users\Admin\Desktop\PopPublish.wma

Filesize
130KB

MD5
7b32b7d53456bba3ec62b6a882628a65

SHA1
470bddd34f4de432c31dc6c6d1e2196ec7f30329

SHA256
3a07282971717fe982e57b0650305cf013003a20815fd712ff41f34067ac79d1

SHA512
548b7f3bac826c2a8ff8071e5d95707345447906316b260368009f66c2646305352957ffcc5eda8a797163a9e25f682ac8ff4c9bb4c3c9fd6e8c0a3d4af8423d

Download Submit
C:\Users\Admin\Desktop\ProtectSubmit.ico

Filesize
143KB

MD5
ddba54f8d07c9a2780b3942a7ffe1139

SHA1
7d516e3c1693fd5eb22bd0c8cc853e2f9fb7ad4b

SHA256
fecef653099362d08cfff988c03fc6e0f350247cf1dc237190f77951e63de914

SHA512
1974911c24dff7547498c1d087d5e1424e1357684c858d413ac6d1f0259aa3267b8aad5b8aed71a538a0e925274d95f9992e4409d989f0dc8bf3cd462b38a25b

Download Submit
C:\Users\Admin\Desktop\ReadMount.ppsx

Filesize
240KB

MD5
4f3ee0cb4f1e1b7d72a4bed8bf1142fc

SHA1
e7a9e7c7ec56e8c45416c90e5d664dc2e84993d0

SHA256
1f87d1e2259d7b719dc68462cb2b515f83f3a1aac0291ed48c2f79c735f2d8f8

SHA512
157fef444a7a05fd3da6d1d49611b9ca6c17046e46d308314b5392b506b52004036acb0b851611933ae7fa7f73500067996c1a5a5ce07322b17719c820ae5280

Download Submit
C:\Users\Admin\Desktop\ReceiveUnprotect.zip

Filesize
228KB

MD5
a2d3816e6090bf2458dab04e187ed074

SHA1
76a86fd92f034200a27f7859d60118d157029d2c

SHA256
c1450749ec913662e3dea71bfb2ec7ddbb3cddd9a2401d1e872bc45c95b4b4a1

SHA512
a41cc37f46dc532e1ee8b9841feb1a1ed25e68d2f455829e8f3afc6d8d08e092b6f7e6fade27bfa2cd7eb90fa66469ba4059b7b612088cab6c60169817b12e07

Download Submit
C:\Users\Admin\Desktop\RedoUpdate.mp4

Filesize
173KB

MD5
3dbaec83e7bcc2131a3ed87427f35bad

SHA1
3f2bf0bfb02a4e0ea0da5bdf2246be2f54d1d3fb

SHA256
5a03e3fe6a748d6bc97e4b847cb5e68754b8e7c15822a5ad9f834b49d9dacbdb

SHA512
9ae56d00d185707567719eef580640365a74669fc4aba426565ee45ebe9b71b76df4d4b939e3ac2a714f64a1b9552c497966c3ff4787fd758cf70a483ca1984c

Download Submit
C:\Users\Admin\Desktop\RestartSync.wvx

Filesize
112KB

MD5
e2011acf05ab130e46e2471bf2b59d81

SHA1
2cf7ab479c6de3c7adad20bd7f925f1025a6fd95

SHA256
78d7abaea69bb54b0e0b1000a351d3bb8b81e179fb0360bdfc594dac5209a401

SHA512
0d4b4c637bb4798b44d5add585649e9df4420420ec07908db2da67bcabbcfda292f20a20d207bd0141a11e28ac1cf7082efcb2c50a89889090acb5aa6452d7b2

Download Submit
C:\Users\Admin\Desktop\RevokeUnregister.xlsx

Filesize
13KB

MD5
0fc85a6ba96cb20fee77e26866e74909

SHA1
cad2959a204e8d94d0b3291e08421caeae390543

SHA256
6146dcb3612b77078b6fa243da5c4668aebb8d25b296dac3d067afa232d77825

SHA512
c66b236db5782150d36853fa9de31ec42bc2017dfdca89936af83d29272b52b42a6c037ddfbc83eff3a1f5aafa7f24ddc5abd0307c5e183424247ec260179b91

Download Submit
C:\Users\Admin\Desktop\SendHide.vsw

Filesize
234KB

MD5
43a45218595c49df1dbc01c049eb65f9

SHA1
6a0353a7cfa54228ad8a8a96997341af0cbbbf4a

SHA256
2ef43f2abca7a484a3a91d1395b24ee816ec95945fda2811c9a23d501dd3b6a2

SHA512
85e02e874171882e4de83813796d348962ed2ac1dd9bf4eec33557face38b586700be3ff7511f480670b92c929210ceb89a454b63c6170273813cfd54db7cc6c

Download Submit
C:\Users\Admin\Desktop\SendReceive.ods

Filesize
124KB

MD5
961f81c969d41fc77ad3c5c927ffa954

SHA1
74ea69fc41d830d7d92c0f8cb163a20e39ed01d8

SHA256
4148f01306130e2edecff5527f9c333d004ad30d0cd870ca7d580b596e40e5f6

SHA512
96abd6359b09d1bfa8fb1f6789e360361b48920a400accde8a90ab71d130c26dcf979f8cef7c63403e8f4efa4aeac7ae096e53adf43927a2b6dac96189a514f4

Download Submit
C:\Users\Admin\Desktop\SplitConfirm.xlsx

Filesize
246KB

MD5
f92f270264bf7ee3f4ca999baaed3a53

SHA1
f9940af7b99a8c09d01c474fbc009870b7f2a7eb

SHA256
5517a67f98a7225604d4d2698f2e375d1607622b67604f6549a89a6eb99e9ed4

SHA512
a4050f4efcc74c8fce589a2c0a9225086aea27b3ccee63722d34984be4272a88c946e59fd9606360564cd5e07576fac4a6803b14982aa8a48494d58ddccbbc3c

Download Submit
C:\Users\Admin\Desktop\StepDisable.xlsx

Filesize
136KB

MD5
a437880188672e4bc07e769bc7afa519

SHA1
c205c9bd07b3353e286a4cab459042be8bb8d3c3

SHA256
bb65556b995fd13784e6f241c3d185247e36e8d6b7e4d3859c7db851f6fa32f0

SHA512
e964cfded63fb8148c49233f0eb2812d6958f7a34ade87ad72af6e89a78e4f4c5abb05c3086a702d99a5ad9594cde5dc2f32e05ae752f9f814e27417f3eea009

Download Submit
C:\Users\Admin\Desktop\SwitchConvert.png

Filesize
118KB

MD5
4a81351574d4821dfbac40ee3b9a3add

SHA1
430ae70a548345d9c421ac9768dd022f46310373

SHA256
cf8d1358746fe86820a9c0e2a5bd5be5e89bab3adf7bfde3d53573e984345613

SHA512
8f5bc001163071f5e66c5487da621dfbd220f53ec641925c8a540a58b5936039026d6fcfdff7ccebde0681560887af11704eca71d579cff79393821317a5cf86

Download Submit
C:\Users\Admin\Desktop\SwitchWatch.cab

Filesize
88KB

MD5
ba612e1d64e69ee3175879ea06a48ed0

SHA1
b79565560d222cdb0f946a7ab86a7e484c72de4e

SHA256
9c271d6680c7d8fe99bc85960246be8efc1765a92619ba0fd7360d6858954322

SHA512
217acc308dfdbd3bb3853b35533b7c431facaef0bf0e6fb5f90b874c3ef68ac35ef98105085228119204db08ca68d6518c561fdce42baac47909f02c08f0d45d

Download Submit
C:\Users\Admin\Desktop\TraceRestore.clr

Filesize
155KB

MD5
aa8efc012bfde9ba3106528bc817d607

SHA1
cfedf5e36edaeb6d5d9ea399ba00d6a9ad2ac485

SHA256
cc85e0dbe9f6293833e6338e7d7eac7917ae599293fb8fe4eef3ed629dbf72fb

SHA512
b56aa2c3f400a42ec836be87e3ae501b86b02dec352a5bb194e9c636b675698a9864499b494dd36e64165e74565bbdd5a5262aec13434f0d5cb952c35ab0ed93

Download Submit
C:\Users\Admin\Desktop\UnblockClear.mp2

Filesize
203KB

MD5
07396ea47e3050804adb1a6eac42e2af

SHA1
63dbb9f1278bc58007e930d8373044fc6afff279

SHA256
69a6dcae589c01362dbebb85897eb8dfb8be3cae1479dc9b727d3238fdfdd72b

SHA512
82bb8bb0b19d705088558f5db6f5038b67d0c5928d469856950ccfe59b1131c6911cd1612bd6894a5d16045f72b3b61060b65c8e071f318e489ad8f916dcdd1d

Download Submit
C:\Users\Admin\Desktop\UninstallGet.dotx

Filesize
210KB

MD5
6ee3a8e23e2ce3b2fd24302bf3662de1

SHA1
dbdc37d9be10933c6fec2afbcbfcb0e3dc78f213

SHA256
eb72be42502c897d15e011822512aac1d47928f99a5b2b9ebb1257f310d07978

SHA512
ad230945672eb7fbeb36be3cc5ebd3e638626818cf43e46a48ea8d48f26bd3b96707be555fc4c63fda89fca55f9cb1548d0e5b0e478c7d6b55e30f7ed09493d8

Download Submit
C:\Users\Admin\Desktop\UnprotectImport.3gpp

Filesize
191KB

MD5
d48609eb6a726abb92664b0b7f2b5ef0

SHA1
bbae2da26865b30c4ba871119e9a4a6b8496cd54

SHA256
150f6bb7c27d48e3516ee65b240d8a670c22559a62a76f6e549c3a0b57c921bc

SHA512
e5cc41cc02976cd349640836c4510f40f3b229df4bf89f95a9e49c4e5a5933a9fe9e205f08b2f743a299f493ed2a9bbb59beccdf4a67e9a87d0f4d3d193b6bd3

Download Submit
C:\Users\Admin\Desktop\UnregisterFormat.php

Filesize
216KB

MD5
3fd3b7e12dae6c9a5e4b8542ea43079f

SHA1
0ed0053f0b6a54ce9f9be515099d01021804a691

SHA256
abf1bfef98f2859619681e094febb2b84b1a204c95c398fd54518628e8416142

SHA512
52070134d3df66ac78bfbc93131d64e900b6219c59d96bd277208254eef25054688abdef4804e652fce06895d72f01e403e8e6f0ec03180a1cd0718ba7c9531c

Download Submit
C:\Users\Admin\Desktop\WatchExpand.htm

Filesize
161KB

MD5
14f0c08f6eb336252bfe3a6085ef760d

SHA1
52311ff7c04ed16290ad98fee32157a848e2055d

SHA256
1146a48db1f6acd4094c8586c825a22e59509b08153215337d78d8cd7a27e7fa

SHA512
515b50a501553ee4023dc3cc2800c0e38aaea9c5c3ba3cc5f27901553f72519a724337dc067c06e4910a8ae205a402df4db938cc44baa1ba6aa0de22325884b8

Download Submit
C:\Users\Admin\Desktop\WatchStart.jpeg

Filesize
100KB

MD5
0202fd614dd389dccb6f2d9f1a10b5a8

SHA1
330f34900c02531e364607848784ddbb09633d52

SHA256
c469a440cc9b1a84f119d37fd0beef5232c04c2f5d18a02dcb6f064f035cd4f9

SHA512
94207ba53dbe440e8e37c7c09c69fcd726017d8637262887439ac2fbf3346c1e84305f10687fbf33c0664af0aa6b45f710a4ae678a5025f66f0842b94ed565eb

Download Submit
C:\Users\Admin\Desktop\WriteClear.xltm

Filesize
185KB

MD5
ca1a027eda03e2337e7e2465c3dc8231

SHA1
cdad91d0c15fffe674fedb8929d41c7c583cdf9e

SHA256
0177ab6a6cdd239cc9da45c9beb31648ef27fb24da178eb4bca4c22886eef8b4

SHA512
5ce638c4430a5404a5783bcd46b1e1db5e4e0f45291b19aa0b886e68682ee20c0de867160f2d0a1463a34bb19d5ee7ba63943372f0858cf1178dbee20d6f7544

Download Submit
C:\Users\Public\Desktop\Adobe Reader 9.lnk

Filesize
1KB

MD5
c39cf3f408b909e6b9b3b477007c7abb

SHA1
cf2184fb6692801dc4cd2213e739abeb94356e54

SHA256
5ebe3605f1944316a6cad98e5b0f0a08ebee8a9272e411a55a4ca45d7857f26d

SHA512
a157722a4d8d5049f653a372beffa2ebc431587c3d90a7059ffd133d318481dc5bd9b66ae0d03da71204f61b8854266fc10c273bb2d668d6aa63cb3b80dd990a

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
931B

MD5
a17d3b54e7946ef3491b89010ed5e39a

SHA1
f11858eb1068bc6008e9250880d53e16f53e1e3a

SHA256
eb4b7aef26f067824c772293301b159eb5bfca68d0f47867d810191c8e08bfe6

SHA512
9c388f625dac18e51dd044d8ea1a1a8ba32c7ed0cbf33ad84904251dd309e44c48225636ee017086210561dcf1e7011ffe04a68b6a1381d71a08df1370ded313

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
a22f5706178eb1c319256f3c4889ffd4

SHA1
20a5b54e78a1e2159c1980be65d38af96be4aa24

SHA256
a7f4b234b0efeb2d64f1161bed29ccfa3054bb5690b216079fa0f08983e3bd7e

SHA512
f5a151dcc78fb6c51e4d8b430680e5774e03791f1f68372be18630a3f39292f036ed6b9c641b1078cfa66749c71add7e64a4d5f90acb0ade4e898a972b27fd22

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
878B

MD5
a6df271b595bce3b9b374b79ae5b4d11

SHA1
f9103976fc6dbe06df8c602d96508b62c9928b46

SHA256
3d33599bcf888bc75513d7be66ebd905587cabf400a02db690e20b9785a21663

SHA512
58abad898da54ce4d0e948d7b36061f3fc732e2d78a01c20af0026c0fe8e221ab32b76e0674ed473ae66c7c4022ea9138bd6870cdd2c3bea018fae0c23b08c93

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll

Filesize
1.7MB

MD5
65ccd6ecb99899083d43f7c24eb8f869

SHA1
27037a9470cc5ed177c0b6688495f3a51996a023

SHA256
aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

SHA512
533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

Download Submit
memory/2656-6-0x000007FEF6120000-0x000007FEF6B0C000-memory.dmp

Filesize
9.9MB

Download
memory/2656-1-0x0000000000220000-0x00000000007C2000-memory.dmp

Filesize
5.6MB

Download
memory/2656-0-0x000007FEF6123000-0x000007FEF6124000-memory.dmp

Filesize
4KB

Download
memory/2656-9-0x000007FEF6120000-0x000007FEF6B0C000-memory.dmp

Filesize
9.9MB

Download