Overview

overview

9

Static

static

3

NitroGenV5.exe

windows10-2004-x64

9

NitroGenV5.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 11:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    NitroGenV5.exe
  • Size 17.3MB
  • Sample260822-nfenvatdpd
  • SHA256 a6c17ceed4cded04fa2f874091f410ca9cf23c936e6d015d9a8c62c6a07c1286
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistencepyinstaller

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 42 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Discovers running processes 1 TTPs 2 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 50 IoCs
  • Suspicious use of SendNotifyMessage 50 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NitroGenV5.exe
    "C:\Users\Admin\AppData\Local\Temp\NitroGenV5.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\NitroGenV5.exe
      "C:\Users\Admin\AppData\Local\Temp\NitroGenV5.exe"
      2⤵
      • Loads dropped DLL
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:5764
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c
        3⤵
        • Executes a command shell one-liner
        PID:2232
      • C:\Windows\SYSTEM32\ipconfig.exe
        ipconfig /all
        3⤵
        • Gathers network information
        PID:3524
      • C:\Windows\System32\Wbem\wmic.exe
        wmic path win32_VideoController get Name
        3⤵
        • Detects videocard installed
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5628
      • C:\Windows\System32\Wbem\wmic.exe
        wmic diskdrive get Model
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3856
      • C:\Windows\SYSTEM32\tasklist.exe
        tasklist /FI "IMAGENAME eq vmtoolsd.exe"
        3⤵
        • Discovers running processes
        PID:4660
      • C:\Windows\SYSTEM32\tasklist.exe
        tasklist /FI "IMAGENAME eq VBoxService.exe"
        3⤵
        • Discovers running processes
        PID:1748
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath 'C:\Users'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5468
      • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe
        "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2172
        • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe
          "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2128
          • C:\Windows\SYSTEM32\reg.exe
            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
            5⤵
            • Modifies registry key
            PID:3444
          • C:\Windows\SYSTEM32\reg.exe
            reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
            5⤵
            • Adds Run key to start application
            • Modifies registry key
            PID:6012
          • C:\Windows\SYSTEM32\reg.exe
            reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
            5⤵
            • Adds Run key to start application
            • Modifies registry key
            PID:5544
          • C:\Windows\SYSTEM32\reg.exe
            reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
            5⤵
            • Adds Run key to start application
            • Modifies registry key
            PID:1456
          • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe
            C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe --worker
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1920
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:2476
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Modifies registry key
              PID:5388
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:2860
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:4088
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:4776
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Modifies registry key
              PID:5912
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              PID:1368
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:5660
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:3612
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:2292
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:764
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:3444
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              PID:304
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:3144
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:760
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:3084
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:5180
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:4908
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:5816
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:4220
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              PID:1748
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:1676
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:2888
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:1140
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:5912
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:5640
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              PID:4296
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:4320
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:5608
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:4308
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:4680
            • C:\Windows\SYSTEM32\reg.exe
              reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
              6⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:4772
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:1236
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:4980
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:5684
  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe
    C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3852
    • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe
      C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4348
      • C:\Windows\SYSTEM32\reg.exe
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:3776
      • C:\Windows\SYSTEM32\reg.exe
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
        3⤵
        • Modifies registry key
        PID:6000
      • C:\Windows\SYSTEM32\reg.exe
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:2076
      • C:\Windows\SYSTEM32\reg.exe
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:684
      • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe
        C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe --worker
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4228
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:5436
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Modifies registry key
          PID:6076
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          PID:5152
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:3716
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:4452
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:6024
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:3732
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:2652
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:1712
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:2488
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:3756
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:5556
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:4316
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:5308
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:3088
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:4644
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:3432
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          PID:1588
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:4752
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:4792
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:4872
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:5884
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Modifies registry key
          PID:4492
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Modifies registry key
          PID:4128
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:6024
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Modifies registry key
          PID:3732
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          PID:2652
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:1008
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          PID:4668
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:1512
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:5576
        • C:\Windows\SYSTEM32\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Terminal /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe /f
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:5448
  • C:\Windows\system32\SecurityHealthService.exe
    C:\Windows\system32\SecurityHealthService.exe
    1⤵
      PID:4648

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI21722\base_library.zip
          • Size 1.3MB
          • SHA256 6c24544441c5eda3e4d23c50334e329da567e6bc603e9422b179a2d44cb027b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\VCRUNTIME140.dll
          • Size 117KB
          • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\_bz2.pyd
          • Size 85KB
          • SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\_ctypes.pyd
          • Size 139KB
          • SHA256 a11d680d89f054584e6a5b2a03103d8731def86e367aff2f70cce8c6367f9025
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\_hashlib.pyd
          • Size 67KB
          • SHA256 0c11671a2c572b4c016be263789f238125419df5711e281acdce8da50d9badda
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\_lzma.pyd
          • Size 157KB
          • SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\_queue.pyd
          • Size 35KB
          • SHA256 8e75c8667f938c3e9b2e9739c09b08517b487437757f125ac400c70c7eadf270
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\_socket.pyd
          • Size 85KB
          • SHA256 42b84410269af5a5578679a3fe7b17d75d28f77a0c3c09d589adadd9d2d3e5f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\_ssl.pyd
          • Size 180KB
          • SHA256 bc17486f149f7311839c70b1cda5a22e4546a9670d3136d665df95ff3cc43abd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\_uuid.pyd
          • Size 27KB
          • SHA256 d75d04aa989f8be9666505ac11339416719e38fc0701047388b061b4e576030a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\_wmi.pyd
          • Size 39KB
          • SHA256 a299a6caf7241cebb0081c3ed9e98f815c61feee3e4813c1fd32369bd3fe6f5e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _zstd.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\_zstd.pyd
          • Size 491KB
          • SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\base_library.zip
          • Size 1.3MB
          • SHA256 f8fa58868ab3e317fa780536e64f117c91b78c5174517b015e94a3ed3c428972
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cacert.pem
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\certifi\cacert.pem
          • Size 264KB
          • SHA256 4f3975ff30abbf35443b486064ae8bcb41dff707ffdf576c76d292fb458aa0a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          md.cp314-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\charset_normalizer\md.cp314-win_amd64.pyd
          • Size 10KB
          • SHA256 394271ca355a08eff4e268efef85f3f817bcc7d8661ac655cb47f24132e7eedf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          md__mypyc.cp314-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\charset_normalizer\md__mypyc.cp314-win_amd64.pyd
          • Size 120KB
          • SHA256 7d28dad4be5242b16e17e75d94bb1117451754f95c8749aae554caa6973d1c6f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          METADATA
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\fake_useragent-2.2.0.dist-info\METADATA
          • Size 17KB
          • SHA256 9abff0d153d01862bcfa307f8e4ab41ceb38ea2e023b5a8a290fbbd6ed8b8889
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          browsers.jsonl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\fake_useragent\data\browsers.jsonl
          • Size 2.5MB
          • SHA256 32270597095ae268d140489e8fa7ffbd44b882c876f4b7a23f347bedcfc227b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\libssl-3.dll
          • Size 776KB
          • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\python3.DLL
          • Size 72KB
          • SHA256 28a395fb2bda5e71084478abea00da9ab1c1dfeb7c4856c258518bee9cc146f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python314.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\python314.dll
          • Size 6.4MB
          • SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\select.pyd
          • Size 32KB
          • SHA256 a0f7b2e00144794e497d11fffc14e7a968f59e207c702ca7b262b7037065b5ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Lorem ipsum.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
          • Size 1KB
          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\ucrtbase.dll
          • Size 1.3MB
          • SHA256 3088326cb0fe5b5646e02c7b2de71ae363fcd26a0000cf32209c8bed05a7a866
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26122\unicodedata.pyd
          • Size 740KB
          • SHA256 64844c24f67e7eafb77142b4cbe4a430f4db3b16f59191586ba6596ca19fc775
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Terminal.exe
          • Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\Terminal.exe
          • Size 9.3MB
          • SHA256 59b8cccd70082866d644ee960c5dad6738028bc0d5d355352ca87dc38cd6035a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft-Defender-Helper.exe
          • Path C:\Users\Admin\AppData\Roaming\AssertPush\Microsoft-Defender-Helper.exe
          • Size 188KB
          • SHA256 b4475619030dfeb8faaa2236a1477097c66c9732196afc98f92b82a21faec03b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OneDrive.exe
          • Path C:\Users\Admin\AppData\Roaming\InitializeConvertFrom\OneDrive.exe
          • Size 186KB
          • SHA256 ee5c344334b0888f42f57e73e9d9a5930ab1960f2749a906684f2a92a36cef80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Settings.exe
          • Path C:\Users\Admin\AppData\Roaming\OutUse\Settings.exe
          • Size 187KB
          • SHA256 898e7a9479516ce9d7f6d0facf11f0ff583054061f1e1663787d257595b9b4e1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/5468-277-0x00000211FC070000-0x00000211FC122000-memory.dmp
          Download

          memory/5468-193-0x00000211FBD90000-0x00000211FBDB2000-memory.dmp
          Download

          memory/5468-276-0x00000211FC050000-0x00000211FC06E000-memory.dmp
          Download

          memory/5468-278-0x00000211FC130000-0x00000211FC13A000-memory.dmp
          Download

          memory/5684-151-0x0000020F78C30000-0x0000020F78C31000-memory.dmp
          Download

          memory/5684-154-0x0000020F78C30000-0x0000020F78C31000-memory.dmp
          Download

          memory/5684-153-0x0000020F78C30000-0x0000020F78C31000-memory.dmp
          Download

          memory/5684-145-0x0000020F78C30000-0x0000020F78C31000-memory.dmp
          Download

          memory/5684-143-0x0000020F78C30000-0x0000020F78C31000-memory.dmp
          Download

          memory/5684-149-0x0000020F78C30000-0x0000020F78C31000-memory.dmp
          Download

          memory/5684-150-0x0000020F78C30000-0x0000020F78C31000-memory.dmp
          Download

          memory/5684-152-0x0000020F78C30000-0x0000020F78C31000-memory.dmp
          Download